Scan Activity

JSON

            
{
  "caption": "Scan Activity",
  "category": "application",
  "description": "Scan events report the start, completion, and results of a scan job. The scan event includes the number of items that were scanned and the number of detections that were resolved.",
  "extends": "base_event",
  "name": "scan_activity",
  "profiles": [
    "host"
  ],
  "uid": 7,
  "attributes": {
    "$include": [
      "profiles/host.json"
    ],
    "command_uid": {
      "description": "The command identifier that is associated with this scan event.  This ID uniquely identifies the proactive scan command, e.g., if remotely initiated.",
      "group": "primary",
      "requirement": "recommended",
      "caption": "Command UID",
      "type": "string_t"
    },
    "activity_id": {
      "enum": {
        "1": {
          "description": "The scan was started.",
          "caption": "Started"
        },
        "2": {
          "description": "The scan was completed.",
          "caption": "Completed"
        },
        "3": {
          "description": "The scan was cancelled.",
          "caption": "Cancelled"
        },
        "4": {
          "description": "The allocated scan time was insufficient to complete the requested scan.",
          "caption": "Duration Violation"
        },
        "5": {
          "description": "The scan was paused, either by the user or by program constraints (e.g. scans that are suspended during certain time intervals), and not resumed within the allotted time.",
          "caption": "Pause Violation"
        },
        "6": {
          "description": "The scan could not be completed due to an internal error.",
          "caption": "Error"
        },
        "7": {
          "description": "The scan was paused.",
          "caption": "Paused"
        },
        "8": {
          "description": "The scan was resumed from the pause point.",
          "caption": "Resumed"
        },
        "9": {
          "description": "The scan restarted from the beginning of the file enumeration.",
          "caption": "Restarted"
        },
        "10": {
          "description": "The user delayed the scan.",
          "caption": "Delayed"
        },
        "0": {
          "caption": "Unknown",
          "description": "The event activity is unknown."
        },
        "99": {
          "caption": "Other",
          "description": "The event activity is not mapped. See the <code>activity_name</code> attribute, which contains a data source specific value."
        }
      },
      "requirement": "required",
      "caption": "Activity ID",
      "description": "The normalized identifier of the activity that triggered the event.",
      "sibling": "activity_name",
      "type": "integer_t"
    },
    "duration": {
      "description": "The duration of the scan",
      "requirement": "recommended",
      "caption": "Duration",
      "type": "integer_t"
    },
    "end_time": {
      "description": "The end time of the scan job.",
      "requirement": "recommended",
      "caption": "End Time",
      "type": "timestamp_t"
    },
    "num_detections": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Detections",
      "description": "The number of detections.",
      "type": "integer_t"
    },
    "num_files": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Scanned Files",
      "description": "The number of files scanned.",
      "type": "integer_t"
    },
    "num_folders": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Scanned Folders",
      "description": "The number of folders scanned.",
      "type": "integer_t"
    },
    "num_network_items": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Scanned Network Items",
      "description": "The number of network items scanned.",
      "type": "integer_t"
    },
    "num_processes": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Scanned Processes",
      "description": "The number of processes scanned.",
      "type": "integer_t"
    },
    "num_registry_items": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Scanned Registry Items",
      "description": "The number of registry items scanned.",
      "type": "integer_t"
    },
    "num_resolutions": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Resolutions",
      "description": "The number of items that were resolved.",
      "type": "integer_t"
    },
    "num_skipped_items": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Skipped",
      "description": "The number of skipped items.",
      "type": "integer_t"
    },
    "num_trusted_items": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Trusted",
      "description": "The number of trusted items.",
      "type": "integer_t"
    },
    "policy": {
      "description": "The policy associated with this Scan event; required if the scan was initiated by a policy.",
      "group": "primary",
      "requirement": "recommended",
      "caption": "Policy",
      "type": "policy"
    },
    "scan": {
      "description": "The Scan object describes characteristics of the scan job.",
      "group": "primary",
      "requirement": "required",
      "caption": "Scan",
      "type": "scan"
    },
    "schedule_uid": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Schedule UID",
      "description": "The unique identifier of the schedule associated with a scan job.",
      "type": "string_t"
    },
    "start_time": {
      "description": "The start time of the scan job.",
      "requirement": "recommended",
      "caption": "Start Time",
      "type": "timestamp_t"
    },
    "total": {
      "description": "The total number of items that were scanned; zero if no items were scanned.",
      "group": "primary",
      "requirement": "recommended",
      "caption": "Total",
      "type": "integer_t"
    },
    "device": {
      "requirement": "recommended",
      "caption": "Device",
      "description": "An addressable device, computer system or host.",
      "type": "device"
    },
    "actor": {
      "requirement": "optional",
      "caption": "Actor",
      "description": "The actor object describes details about the user/role/process that was the source of the activity.",
      "type": "actor"
    },
    "enrichments": {
      "group": "context",
      "requirement": "optional",
      "caption": "Enrichments",
      "description": "The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:</p><code>[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]</code>",
      "is_array": true,
      "type": "enrichment"
    },
    "message": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Message",
      "description": "The description of the event/finding, as defined by the source.",
      "type": "string_t"
    },
    "metadata": {
      "group": "context",
      "requirement": "required",
      "caption": "Metadata",
      "description": "The metadata associated with the event or a finding.",
      "type": "metadata"
    },
    "observables": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Observables",
      "description": "The observables associated with the event or a finding.",
      "is_array": true,
      "type": "observable"
    },
    "raw_data": {
      "group": "context",
      "requirement": "optional",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "severity": {
      "group": "classification",
      "requirement": "optional",
      "caption": "Severity",
      "description": "The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.",
      "type": "string_t"
    },
    "severity_id": {
      "group": "classification",
      "requirement": "required",
      "caption": "Severity ID",
      "description": "<p>The normalized identifier of the event/finding severity.</p>The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.",
      "enum": {
        "99": {
          "caption": "Other",
          "description": "The event/finding severity is not mapped. See the <code>severity</code> attribute, which contains a data source specific value."
        },
        "0": {
          "caption": "Unknown",
          "description": "The event severity is not known."
        },
        "1": {
          "caption": "Informational",
          "description": "Informational message. No action required."
        },
        "2": {
          "caption": "Low",
          "description": "The user decides if action is needed."
        },
        "3": {
          "caption": "Medium",
          "description": "Action is required but the situation is not serious at this time."
        },
        "4": {
          "caption": "High",
          "description": "Action is required immediately."
        },
        "5": {
          "caption": "Critical",
          "description": "Action is required immediately and the scope is broad."
        },
        "6": {
          "caption": "Fatal",
          "description": "An error occurred but it is too late to take remedial action."
        }
      },
      "sibling": "severity",
      "type": "integer_t"
    },
    "status": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Status",
      "description": "The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.",
      "type": "string_t"
    },
    "status_code": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Status Code",
      "description": "The event status code, as reported by the event source.<br /><br />For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.",
      "type": "string_t"
    },
    "status_detail": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Status Details",
      "description": "The status details contains additional information about the event/finding outcome.",
      "type": "string_t"
    },
    "status_id": {
      "group": "primary",
      "requirement": "recommended",
      "caption": "Status ID",
      "description": "The normalized identifier of the event status.",
      "enum": {
        "99": {
          "caption": "Other",
          "description": "The event status is not mapped. See the <code>status</code> attribute, which contains a data source specific value."
        },
        "0": {
          "caption": "Unknown",
          "description": "The status is unknown."
        },
        "1": {
          "caption": "Success"
        },
        "2": {
          "caption": "Failure"
        }
      },
      "sibling": "status",
      "type": "integer_t"
    },
    "unmapped": {
      "group": "context",
      "requirement": "optional",
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    },
    "activity_name": {
      "requirement": "optional",
      "caption": "Activity",
      "description": "The event activity name, as defined by the activity_id.",
      "type": "string_t"
    },
    "category_name": {
      "requirement": "optional",
      "caption": "Category",
      "description": "The event category name, as defined by category_uid value.",
      "type": "string_t"
    },
    "category_uid": {
      "enum": {
        "6": {
          "caption": "Application Activity",
          "description": "Application Activity events report detailed information about the behavior of applications and services."
        }
      },
      "requirement": "required",
      "caption": "Category ID",
      "description": "The category unique identifier of the event.",
      "sibling": "category_name",
      "type": "integer_t"
    },
    "class_name": {
      "requirement": "optional",
      "caption": "Class",
      "description": "The event class name, as defined by class_uid value.",
      "type": "string_t"
    },
    "class_uid": {
      "enum": {
        "6007": {
          "caption": "Scan Activity",
          "description": "Scan events report the start, completion, and results of a scan job. The scan event includes the number of items that were scanned and the number of detections that were resolved."
        }
      },
      "requirement": "required",
      "caption": "Class ID",
      "description": "The unique identifier of a class. A class describes the attributes available in an event.",
      "sibling": "class_name",
      "type": "integer_t"
    },
    "type_name": {
      "requirement": "optional",
      "caption": "Type Name",
      "description": "The event/finding type name, as defined by the type_uid.",
      "type": "string_t"
    },
    "type_uid": {
      "requirement": "required",
      "caption": "Type ID",
      "description": "The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: <code>class_uid * 100 + activity_id</code>.",
      "sibling": "type_name",
      "type": "long_t",
      "enum": {
        "600701": {
          "caption": "Scan Activity: Started"
        },
        "600702": {
          "caption": "Scan Activity: Completed"
        },
        "600703": {
          "caption": "Scan Activity: Cancelled"
        },
        "600704": {
          "caption": "Scan Activity: Duration Violation"
        },
        "600705": {
          "caption": "Scan Activity: Pause Violation"
        },
        "600706": {
          "caption": "Scan Activity: Error"
        },
        "600707": {
          "caption": "Scan Activity: Paused"
        },
        "600708": {
          "caption": "Scan Activity: Resumed"
        },
        "600709": {
          "caption": "Scan Activity: Restarted"
        },
        "600710": {
          "caption": "Scan Activity: Delayed"
        },
        "600700": {
          "caption": "Scan Activity: Unknown"
        },
        "600799": {
          "caption": "Scan Activity: Other"
        }
      }
    },
    "count": {
      "requirement": "optional",
      "caption": "Count",
      "description": "The number of times that events in the same logical group occurred during the event <strong>Start Time</strong> to <strong>End Time</strong> period.",
      "type": "integer_t",
      "default": 1
    },
    "time": {
      "requirement": "required",
      "caption": "Event Time",
      "description": "The normalized event occurrence time or the finding creation time.",
      "type": "timestamp_t"
    },
    "timezone_offset": {
      "requirement": "recommended",
      "caption": "Timezone Offset",
      "description": "The number of minutes that the reported event <code>time</code> is ahead or behind UTC, in the range -1,080 to +1,080.",
      "type": "integer_t"
    },
    "cloud": {
      "requirement": "required",
      "group": "primary",
      "caption": "Cloud",
      "description": "Describes details about the Cloud environment where the event was originally created or logged.",
      "type": "cloud"
    },
    "api": {
      "requirement": "optional",
      "group": "context",
      "caption": "API Details",
      "description": "Describes details about a typical API (Application Programming Interface) call.",
      "type": "api"
    },
    "data": {
      "description": "Additional data that is associated with the event.",
      "requirement": "optional",
      "caption": "Data",
      "type": "json_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "confidence": {
      "group": "classification",
      "requirement": "optional",
      "caption": "Confidence",
      "description": "The confidence of the reported event severity as a percentage: 0%-100%.",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "record_id": {
      "description": "Unique idenifier for the event",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    }
  }
}