Datastore Activity
Datastore Activity is a searchable entity at the top of Query's UI.
datastore_activity (6005)
Datastore events describe general activities (Read, Update, Query, Delete, etc.) which affect datastores or data within those datastores, e.g. (AWS RDS, AWS S3).
Contents
Attributes
| Caption | Name | Type | Is Array | Default | Description |
|---|---|---|---|---|---|
| Action | action | String |
The normalized caption of action_id.
|
||
| Action ID | action_id | Integer |
The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of 1 'Allowed' or 2 'Denied' in most cases. Note that 99 'Other' is not an option. No action would equate to 1 'Allowed'. An unknown action may still correspond to a known disposition. Refer to disposition_id for the outcome of the action.
|
||
| Activity ID | activity_id | Integer |
The normalized identifier of the activity that triggered the event.
|
||
| Activity | activity_name | String | The event activity name, as defined by the activity_id. | ||
| Actor | actor | Actor |
The actor that performed the operation or the action.
Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0 |
||
| API Details | api | API | Describes details about a typical API (Application Programming Interface) call. | ||
| MITRE ATT&CK® Details | attacks | MITRE ATT&CK® | An array of MITRE ATT&CK® objects describing the tactics, techniques & sub-techniques identified by a security control or finding. | ||
| Authorization Information | authorizations | Authorization Result | Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event. | ||
| Category | category_name | String | The event category name, as defined by category_uid value. | ||
| Category ID | category_uid | Integer |
The category unique identifier of the event.
|
||
| Class | class_name | String | The event class name, as defined by class_uid value. | ||
| Class ID | class_uid | Integer |
The unique identifier of a class. A class describes the attributes available in an event.
|
||
| Cloud | cloud | Cloud | Describes details about the Cloud environment where the event was originally created or logged. | ||
| Confidence | confidence | Integer |
The confidence of the reported event severity as a percentage: 0%-100%.
Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0 |
||
| Count | count | Integer | 1 | The number of times that events in the same logical group occurred during the event Start Time to End Time period. | |
| Data | data | JSON |
Additional data that is associated with the event.
Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0 |
||
| Database | database | Database | The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data. | ||
| Databucket | databucket | Databucket | The data bucket object is a basic container that holds data, typically organized through the use of data partitions. | ||
| Device | device | Device |
The device that reported the event.
Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0 |
||
| Disposition | disposition | String | The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source. | ||
| Disposition ID | disposition_id | Integer |
Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.
|
||
| Destination Endpoint | dst_endpoint | Network Endpoint | Details about the endpoint hosting the datastore application or service. | ||
| Duration | duration | Integer |
The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
|
||
| End Time | end_time | Timestamp | The end time of a time period, or the time of the most recent event included in the aggregate event. | ||
| Enrichments | enrichments | Enrichment |
The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
|
||
| Firewall Rule | firewall_rule | Firewall Rule | The firewall rule that triggered the event. | ||
| HTTP Request | http_request | HTTP Request | Details about the underlying http request. | ||
| Malware | malware | Malware | A list of Malware objects, describing details about the identified malware. | ||
| Message | message | String | The description of the event/finding, as defined by the source. | ||
| Metadata | metadata | Metadata | The metadata associated with the event or a finding. | ||
| Observables | observables | Observable | The observables associated with the event or a finding. | ||
| Query Info | query_info | Query Information | The query info object holds information related to data access within a datastore. To access, manipulate, delete, or retrieve data from a datastore, a database query must be written using a specific syntax. | ||
| Raw Data | raw_data | JSON | The event data as received from the event source. | ||
| Record ID | record_id | String | Unique idenifier for the event | ||
| Severity | severity | String | The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source. | ||
| Severity ID | severity_id | Integer |
The normalized identifier of the event/finding severity. The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.
|
||
| Source Endpoint | src_endpoint | Network Endpoint | Details about the source of the activity. | ||
| Start Time | start_time | Timestamp | The start time of a time period, or the time of the least recent event included in the aggregate event. | ||
| Status | status | String | The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source. | ||
| Status Code | status_code | String |
The event status code, as reported by the event source. For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18. |
||
| Status Details | status_detail | String | The status details contains additional information about the event/finding outcome. | ||
| Status ID | status_id | Integer |
The normalized identifier of the event status.
|
||
| Table | table | Table | The table object represents a table within a structured relational database or datastore, which contains columns and rows of data that are able to be create, updated, deleted and queried. | ||
| Event Time | time | Timestamp | The normalized event occurrence time or the finding creation time. | ||
| Timezone Offset | timezone_offset | Integer |
The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.
|
||
| Datastore Type | type | String | The datastore resource type (e.g. database, datastore, or table). | ||
| Datastore Type ID | type_id | Integer |
The normalized datastore resource type identifier.
|
||
| Type Name | type_name | String | The event/finding type name, as defined by the type_uid. | ||
| Type ID | type_uid | Long |
The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
|
||
| Unmapped Data | unmapped | Unmapped | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
References
Referenced By
Context
JSON
{
"uid": 5,
"description": "Datastore events describe general activities (Read, Update, Query, Delete, etc.) which affect datastores or data within those datastores, e.g. (AWS RDS, AWS S3).",
"extends": "application",
"caption": "Datastore Activity",
"name": "datastore_activity",
"profiles": [
"security_control"
],
"attributes": {
"$include": [
"profiles/security_control.json"
],
"activity_id": {
"enum": {
"1": {
"caption": "Read",
"description": "The datastore activity in the event pertains to a 'Read' operation."
},
"2": {
"caption": "Update",
"description": "The datastore activity in the event pertains to a 'Update' operation."
},
"3": {
"caption": "Connect",
"description": "The datastore activity in the event pertains to a 'Connect' operation."
},
"4": {
"caption": "Query",
"description": "The datastore activity in the event pertains to a 'Query' operation."
},
"5": {
"caption": "Write",
"description": "The datastore activity in the event pertains to a 'Write' operation."
},
"6": {
"caption": "Create",
"description": "The datastore activity in the event pertains to a 'Create' operation."
},
"7": {
"caption": "Delete",
"description": "The datastore activity in the event pertains to a 'Delete' operation."
},
"8": {
"caption": "List",
"description": "The 'List' activity provides an overview of existing data records."
},
"9": {
"caption": "Encrypt",
"description": "The 'Encrypt' activity involves securing data by encrypting a specific data record."
},
"10": {
"caption": "Decrypt",
"description": "The 'Decrypt' activity involves converting encrypted data back to its original format."
},
"0": {
"caption": "Unknown",
"description": "The event activity is unknown."
},
"99": {
"caption": "Other",
"description": "The event activity is not mapped. See the <code>activity_name</code> attribute, which contains a data source specific value."
}
},
"requirement": "required",
"caption": "Activity ID",
"description": "The normalized identifier of the activity that triggered the event.",
"sibling": "activity_name",
"type": "integer_t"
},
"database": {
"group": "primary",
"requirement": "recommended",
"caption": "Database",
"description": "The database object is used for databases which are typically datastore services that contain an organized collection of structured and unstructured data or a types of data.",
"type": "database"
},
"databucket": {
"group": "primary",
"requirement": "recommended",
"caption": "Databucket",
"description": "The data bucket object is a basic container that holds data, typically organized through the use of data partitions.",
"type": "databucket"
},
"table": {
"group": "primary",
"requirement": "recommended",
"caption": "Table",
"description": "The table object represents a table within a structured relational database or datastore, which contains columns and rows of data that are able to be create, updated, deleted and queried.",
"type": "table"
},
"type": {
"caption": "Datastore Type",
"description": "The datastore resource type (e.g. database, datastore, or table).",
"requirement": "optional",
"type": "string_t"
},
"type_id": {
"caption": "Datastore Type ID",
"description": "The normalized datastore resource type identifier.",
"enum": {
"99": {
"caption": "Other",
"description": "The datastore resource type is not mapped."
},
"0": {
"caption": "Unknown",
"description": "The datastore resource type is unknown."
},
"1": {
"caption": "Database"
},
"2": {
"caption": "Databucket"
},
"3": {
"caption": "Table"
}
},
"requirement": "recommended",
"sibling": "type",
"type": "integer_t"
},
"query_info": {
"group": "primary",
"requirement": "recommended",
"caption": "Query Info",
"description": "The query info object holds information related to data access within a datastore. To access, manipulate, delete, or retrieve data from a datastore, a database query must be written using a specific syntax.",
"type": "query_info"
},
"dst_endpoint": {
"description": "Details about the endpoint hosting the datastore application or service.",
"group": "primary",
"requirement": "recommended",
"caption": "Destination Endpoint",
"type": "network_endpoint"
},
"http_request": {
"description": "Details about the underlying http request.",
"group": "primary",
"requirement": "recommended",
"caption": "HTTP Request",
"type": "http_request"
},
"actor": {
"group": "primary",
"requirement": "required",
"caption": "Actor",
"description": "The actor that performed the operation or the action.",
"type": "actor",
"@deprecated": {
"since": "1.1.0",
"message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
}
},
"src_endpoint": {
"description": "Details about the source of the activity.",
"group": "primary",
"requirement": "required",
"caption": "Source Endpoint",
"type": "network_endpoint"
},
"action": {
"caption": "Action",
"description": "The normalized caption of <code>action_id</code>.",
"requirement": "optional",
"type": "string_t"
},
"action_id": {
"caption": "Action ID",
"description": "The action taken by a control or other policy-based system leading to an outcome or disposition. Dispositions conform to an action of <code>1</code> 'Allowed' or <code>2</code> 'Denied' in most cases. Note that <code>99</code> 'Other' is not an option. No action would equate to <code>1</code> 'Allowed'. An unknown action may still correspond to a known disposition. Refer to <code>disposition_id</code> for the outcome of the action.",
"enum": {
"0": {
"caption": "Unknown",
"description": "The action was unknown. The <code>disposition_id</code> attribute may still be set to a non-unknown value, for example 'Count', 'Uncorrected', 'Isolated', 'Quarantined' or 'Exonerated'."
},
"1": {
"caption": "Allowed",
"description": "The activity was allowed. The <code>disposition_id</code> attribute should be set to a value that conforms to this action, for example 'Allowed', 'Approved', 'Delayed', 'No Action', 'Count' etc."
},
"2": {
"caption": "Denied",
"description": "The attempted activity was denied. The <code>disposition_id</code> attribute should be set to a value that conforms to this action, for example 'Blocked', 'Rejected', 'Quarantined', 'Isolated', 'Dropped', 'Access Revoked, etc."
},
"99": {
"caption": "Other",
"description": "The action was not mapped. See the <code>action</code> attribute, which contains a data source specific value."
}
},
"requirement": "required",
"type": "integer_t",
"sibling": "action"
},
"attacks": {
"requirement": "optional",
"caption": "MITRE ATT&CK\u00ae Details",
"description": "An array of <a target='_blank' href='https://attack.mitre.org'>MITRE ATT&CK\u00ae</a> objects describing the tactics, techniques & sub-techniques identified by a security control or finding.",
"is_array": true,
"type": "attack"
},
"authorizations": {
"requirement": "optional",
"caption": "Authorization Information",
"description": "Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.",
"is_array": true,
"type": "authorization"
},
"disposition": {
"requirement": "optional",
"caption": "Disposition",
"description": "The disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source.",
"type": "string_t"
},
"disposition_id": {
"requirement": "recommended",
"enum": {
"99": {
"caption": "Other",
"description": "The disposition is not listed. The <code>disposition</code> attribute should be populated with a source specific caption."
},
"0": {
"caption": "Unknown",
"description": "The disposition was not known."
},
"1": {
"caption": "Allowed",
"description": "Granted access or allowed the action to the protected resource."
},
"2": {
"caption": "Blocked",
"description": "Denied access or blocked the action to the protected resource."
},
"3": {
"caption": "Quarantined",
"description": "A suspicious file or other content was moved to a benign location."
},
"4": {
"caption": "Isolated",
"description": "A session was isolated on the network or within a browser."
},
"5": {
"caption": "Deleted",
"description": "A file or other content was deleted."
},
"6": {
"caption": "Dropped",
"description": "The request was detected as a threat and resulted in the connection being dropped."
},
"7": {
"caption": "Custom Action",
"description": "A custom action was executed such as running of a command script. Use the <code>message</code> attribute of the base class for details."
},
"8": {
"caption": "Approved",
"description": "A request or submission was approved. For example, when a form was properly filled out and submitted. This is distinct from <code>1</code> 'Allowed'."
},
"9": {
"caption": "Restored",
"description": "A quarantined file or other content was restored to its original location."
},
"10": {
"caption": "Exonerated",
"description": "A suspicious or risky entity was deemed to no longer be suspicious (re-scored)."
},
"11": {
"caption": "Corrected",
"description": "A corrupt file or configuration was corrected."
},
"12": {
"caption": "Partially Corrected",
"description": "A corrupt file or configuration was partially corrected."
},
"13": {
"caption": "Uncorrected",
"description": "A corrupt file or configuration was not corrected."
},
"14": {
"caption": "Delayed",
"description": "An operation was delayed, for example if a restart was required to finish the operation."
},
"15": {
"caption": "Detected",
"description": "Suspicious activity or a policy violation was detected without further action."
},
"16": {
"caption": "No Action",
"description": "The outcome of an operation had no action taken."
},
"17": {
"caption": "Logged",
"description": "The operation or action was logged without further action."
},
"18": {
"caption": "Tagged",
"description": "A file or other entity was marked with extended attributes."
},
"19": {
"caption": "Alert",
"description": "The request or activity was detected as a threat and resulted in a notification but request was not blocked."
},
"20": {
"caption": "Count",
"description": "Counted the request or activity but did not determine whether to allow it or block it."
},
"21": {
"caption": "Reset",
"description": "The request was detected as a threat and resulted in the connection being reset."
},
"22": {
"caption": "Captcha",
"description": "Required the end user to solve a CAPTCHA puzzle to prove that a human being is sending the request."
},
"23": {
"caption": "Challenge",
"description": "Ran a silent challenge that required the client session to verify that it's a browser, and not a bot."
},
"24": {
"caption": "Access Revoked",
"description": "The requestor's access has been revoked due to security policy enforcements. Note: use the <code>Host</code> profile if the <code>User</code> or <code>Actor</code> requestor is not present in the event class."
},
"25": {
"caption": "Rejected",
"description": "A request or submission was rejected. For example, when a form was improperly filled out and submitted. This is distinct from <code>2</code> 'Blocked'."
},
"26": {
"caption": "Unauthorized",
"description": "An attempt to access a resource was denied due to an authorization check that failed. This is a more specific disposition than <code>2</code> 'Blocked' and can be complemented with the <code>authorizations</code> attribute for more detail."
},
"27": {
"caption": "Error",
"description": "An error occurred during the processing of the activity or request. Use the <code>message</code> attribute of the base class for details."
}
},
"caption": "Disposition ID",
"description": "Describes the outcome or action taken by a security control, such as access control checks, malware detections or various types of policy violations.",
"sibling": "disposition",
"type": "integer_t"
},
"firewall_rule": {
"requirement": "optional",
"caption": "Firewall Rule",
"description": "The firewall rule that triggered the event.",
"type": "firewall_rule"
},
"malware": {
"requirement": "optional",
"caption": "Malware",
"description": "A list of Malware objects, describing details about the identified malware.",
"is_array": true,
"type": "malware"
},
"enrichments": {
"group": "context",
"requirement": "optional",
"caption": "Enrichments",
"description": "The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:</p><code>[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]</code>",
"is_array": true,
"type": "enrichment"
},
"message": {
"group": "primary",
"requirement": "recommended",
"caption": "Message",
"description": "The description of the event/finding, as defined by the source.",
"type": "string_t"
},
"metadata": {
"group": "context",
"requirement": "required",
"caption": "Metadata",
"description": "The metadata associated with the event or a finding.",
"type": "metadata"
},
"observables": {
"group": "primary",
"requirement": "recommended",
"caption": "Observables",
"description": "The observables associated with the event or a finding.",
"is_array": true,
"type": "observable"
},
"raw_data": {
"group": "context",
"requirement": "optional",
"caption": "Raw Data",
"description": "The event data as received from the event source.",
"type": "json_t"
},
"severity": {
"group": "classification",
"requirement": "optional",
"caption": "Severity",
"description": "The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.",
"type": "string_t"
},
"severity_id": {
"group": "classification",
"requirement": "required",
"caption": "Severity ID",
"description": "<p>The normalized identifier of the event/finding severity.</p>The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.",
"enum": {
"99": {
"caption": "Other",
"description": "The event/finding severity is not mapped. See the <code>severity</code> attribute, which contains a data source specific value."
},
"0": {
"caption": "Unknown",
"description": "The event severity is not known."
},
"1": {
"caption": "Informational",
"description": "Informational message. No action required."
},
"2": {
"caption": "Low",
"description": "The user decides if action is needed."
},
"3": {
"caption": "Medium",
"description": "Action is required but the situation is not serious at this time."
},
"4": {
"caption": "High",
"description": "Action is required immediately."
},
"5": {
"caption": "Critical",
"description": "Action is required immediately and the scope is broad."
},
"6": {
"caption": "Fatal",
"description": "An error occurred but it is too late to take remedial action."
}
},
"sibling": "severity",
"type": "integer_t"
},
"status": {
"group": "primary",
"requirement": "recommended",
"caption": "Status",
"description": "The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.",
"type": "string_t"
},
"status_code": {
"group": "primary",
"requirement": "recommended",
"caption": "Status Code",
"description": "The event status code, as reported by the event source.<br /><br />For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.",
"type": "string_t"
},
"status_detail": {
"group": "primary",
"requirement": "recommended",
"caption": "Status Details",
"description": "The status details contains additional information about the event/finding outcome.",
"type": "string_t"
},
"status_id": {
"group": "primary",
"requirement": "recommended",
"caption": "Status ID",
"description": "The normalized identifier of the event status.",
"enum": {
"99": {
"caption": "Other",
"description": "The event status is not mapped. See the <code>status</code> attribute, which contains a data source specific value."
},
"0": {
"caption": "Unknown",
"description": "The status is unknown."
},
"1": {
"caption": "Success"
},
"2": {
"caption": "Failure"
}
},
"sibling": "status",
"type": "integer_t"
},
"unmapped": {
"group": "context",
"requirement": "optional",
"caption": "Unmapped Data",
"description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
"type": "unmapped",
"is_array": true
},
"activity_name": {
"requirement": "optional",
"caption": "Activity",
"description": "The event activity name, as defined by the activity_id.",
"type": "string_t"
},
"category_name": {
"requirement": "optional",
"caption": "Category",
"description": "The event category name, as defined by category_uid value.",
"type": "string_t"
},
"category_uid": {
"enum": {
"6": {
"caption": "Application Activity",
"description": "Application Activity events report detailed information about the behavior of applications and services."
}
},
"requirement": "required",
"caption": "Category ID",
"description": "The category unique identifier of the event.",
"sibling": "category_name",
"type": "integer_t"
},
"class_name": {
"requirement": "optional",
"caption": "Class",
"description": "The event class name, as defined by class_uid value.",
"type": "string_t"
},
"class_uid": {
"enum": {
"6005": {
"caption": "Datastore Activity",
"description": "Datastore events describe general activities (Read, Update, Query, Delete, etc.) which affect datastores or data within those datastores, e.g. (AWS RDS, AWS S3)."
}
},
"requirement": "required",
"caption": "Class ID",
"description": "The unique identifier of a class. A class describes the attributes available in an event.",
"sibling": "class_name",
"type": "integer_t"
},
"type_name": {
"requirement": "optional",
"caption": "Type Name",
"description": "The event/finding type name, as defined by the type_uid.",
"type": "string_t"
},
"type_uid": {
"requirement": "required",
"caption": "Type ID",
"description": "The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: <code>class_uid * 100 + activity_id</code>.",
"sibling": "type_name",
"type": "long_t",
"enum": {
"600501": {
"caption": "Datastore Activity: Read"
},
"600502": {
"caption": "Datastore Activity: Update"
},
"600503": {
"caption": "Datastore Activity: Connect"
},
"600504": {
"caption": "Datastore Activity: Query"
},
"600505": {
"caption": "Datastore Activity: Write"
},
"600506": {
"caption": "Datastore Activity: Create"
},
"600507": {
"caption": "Datastore Activity: Delete"
},
"600508": {
"caption": "Datastore Activity: List"
},
"600509": {
"caption": "Datastore Activity: Encrypt"
},
"600510": {
"caption": "Datastore Activity: Decrypt"
},
"600500": {
"caption": "Datastore Activity: Unknown"
},
"600599": {
"caption": "Datastore Activity: Other"
}
}
},
"count": {
"requirement": "optional",
"caption": "Count",
"description": "The number of times that events in the same logical group occurred during the event <strong>Start Time</strong> to <strong>End Time</strong> period.",
"type": "integer_t",
"default": 1
},
"duration": {
"requirement": "optional",
"caption": "Duration",
"description": "The event duration or aggregate time, the amount of time the event covers from <code>start_time</code> to <code>end_time</code> in milliseconds.",
"type": "integer_t"
},
"end_time": {
"description": "The end time of a time period, or the time of the most recent event included in the aggregate event.",
"requirement": "optional",
"caption": "End Time",
"type": "timestamp_t"
},
"start_time": {
"description": "The start time of a time period, or the time of the least recent event included in the aggregate event.",
"requirement": "optional",
"caption": "Start Time",
"type": "timestamp_t"
},
"time": {
"requirement": "required",
"caption": "Event Time",
"description": "The normalized event occurrence time or the finding creation time.",
"type": "timestamp_t"
},
"timezone_offset": {
"requirement": "recommended",
"caption": "Timezone Offset",
"description": "The number of minutes that the reported event <code>time</code> is ahead or behind UTC, in the range -1,080 to +1,080.",
"type": "integer_t"
},
"cloud": {
"requirement": "required",
"group": "primary",
"caption": "Cloud",
"description": "Describes details about the Cloud environment where the event was originally created or logged.",
"type": "cloud"
},
"api": {
"requirement": "optional",
"group": "context",
"caption": "API Details",
"description": "Describes details about a typical API (Application Programming Interface) call.",
"type": "api"
},
"data": {
"description": "Additional data that is associated with the event.",
"requirement": "optional",
"caption": "Data",
"type": "json_t",
"@deprecated": {
"since": "1.1.0",
"message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
}
},
"confidence": {
"group": "classification",
"requirement": "optional",
"caption": "Confidence",
"description": "The confidence of the reported event severity as a percentage: 0%-100%.",
"type": "integer_t",
"@deprecated": {
"since": "1.1.0",
"message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
}
},
"record_id": {
"description": "Unique idenifier for the event",
"group": "primary",
"requirement": "required",
"caption": "Record ID",
"type": "string_t"
},
"device": {
"requirement": "recommended",
"caption": "Device",
"description": "The device that reported the event.",
"type": "device",
"@deprecated": {
"since": "1.1.0",
"message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
}
}
},
"constraints": {
"at_least_one": [
"database",
"databucket",
"table"
]
},
"category": "application"
}