Web Resource Access Activity
web_resource_access_activity (6004)
Web Resource Access Activity events describe successful/failed attempts to access a web resource over HTTP.
Deprecated since 1.0.0: Use the Web Resources Activity
class with the Security Control
and/or Network Proxy
profile instead.
Contents
Attributes
Caption | Name | Type | Is Array | Default | Description |
---|---|---|---|---|---|
Activity ID | activity_id | Integer |
The normalized identifier of the activity that triggered the event.
|
||
Activity | activity_name | String | The event activity name, as defined by the activity_id. | ||
Actor | actor | Actor |
The actor object describes details about the user/role/process that was the source of the activity.
Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0 |
||
API Details | api | API | Describes details about a typical API (Application Programming Interface) call. | ||
Category | category_name | String | The event category name, as defined by category_uid value. | ||
Category ID | category_uid | Integer |
The category unique identifier of the event.
|
||
Class | class_name | String | The event class name, as defined by class_uid value. | ||
Class ID | class_uid | Integer |
The unique identifier of a class. A class describes the attributes available in an event.
|
||
Cloud | cloud | Cloud | Describes details about the Cloud environment where the event was originally created or logged. | ||
Confidence | confidence | Integer |
The confidence of the reported event severity as a percentage: 0%-100%.
Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0 |
||
Count | count | Integer | 1 | The number of times that events in the same logical group occurred during the event Start Time to End Time period. | |
Data | data | JSON |
Additional data that is associated with the event.
Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0 |
||
Device | device | Device |
An addressable device, computer system or host.
Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0 |
||
Duration | duration | Integer |
The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds.
|
||
End Time | end_time | Timestamp | The end time of a time period, or the time of the most recent event included in the aggregate event. | ||
Enrichments | enrichments | Enrichment |
The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:[{"name": "answers.ip", "value": "92.24.47.250", "type": "location", "data": {"city": "Socotra", "continent": "Asia", "coordinates": [-25.4153, 17.0743], "country": "YE", "desc": "Yemen"}}]
|
||
HTTP Request | http_request | HTTP Request | Details about the underlying HTTP request. | ||
HTTP Response | http_response | HTTP Response | Details about the HTTP response, if available. | ||
Message | message | String | The description of the event/finding, as defined by the source. | ||
Metadata | metadata | Metadata | The metadata associated with the event or a finding. | ||
Observables | observables | Observable | The observables associated with the event or a finding. | ||
Proxy | proxy | Network Proxy Endpoint |
Details about the proxy service, if available.
Deprecated since 1.1.0: Use the |
||
Proxy Connection Info | proxy_connection_info | Network Connection Information | The connection information from the proxy server to the remote server. | ||
Proxy Endpoint | proxy_endpoint | Network Proxy Endpoint | The proxy (server) in a network connection. | ||
Proxy HTTP Request | proxy_http_request | HTTP Request | The HTTP Request from the proxy server to the remote server. | ||
Proxy HTTP Response | proxy_http_response | HTTP Response | The HTTP Response from the remote server to the proxy server. | ||
Proxy TLS | proxy_tls | Transport Layer Security (TLS) | The TLS protocol negotiated between the proxy server and the remote server. | ||
Proxy Traffic | proxy_traffic | Network Traffic | The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time. | ||
Raw Data | raw_data | JSON | The event data as received from the event source. | ||
Record ID | record_id | String | Unique idenifier for the event | ||
Severity | severity | String | The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source. | ||
Severity ID | severity_id | Integer |
The normalized identifier of the event/finding severity. The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.
|
||
Source Endpoint | src_endpoint | Network Endpoint | Details about the source endpoint of the request. | ||
Start Time | start_time | Timestamp | The start time of a time period, or the time of the least recent event included in the aggregate event. | ||
Status | status | String | The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source. | ||
Status Code | status_code | String |
The event status code, as reported by the event source. For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18. |
||
Status Details | status_detail | String | The status details contains additional information about the event/finding outcome. | ||
Status ID | status_id | Integer |
The normalized identifier of the event status.
|
||
Event Time | time | Timestamp | The normalized event occurrence time or the finding creation time. | ||
Timezone Offset | timezone_offset | Integer |
The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080.
|
||
TLS | tls | Transport Layer Security (TLS) | The Transport Layer Security (TLS) attributes, if available. | ||
Type Name | type_name | String | The event/finding type name, as defined by the type_uid. | ||
Type ID | type_uid | Long |
The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id .
|
||
Unmapped Data | unmapped | Unmapped | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. | ||
Web Resources | web_resources | Web Resource | Details about the resource that is the target of the activity. |
References
- HTTP Request
- HTTP Response
- Network Proxy Endpoint
- Web Resource
- Network Endpoint
- Transport Layer Security (TLS)
- Network Proxy Endpoint
- Network Connection Information
- HTTP Request
- HTTP Response
- Network Traffic
- Transport Layer Security (TLS)
- Device
- Actor
- Enrichment
- Metadata
- Observable
- Unmapped
- Cloud
- API
Referenced By
Context
JSON
{
"caption": "Web Resource Access Activity",
"category": "application",
"description": "Web Resource Access Activity events describe successful/failed attempts to access a web resource over HTTP.",
"extends": "application",
"name": "web_resource_access_activity",
"uid": 4,
"@deprecated": {
"message": "Use the <code>Web Resources Activity</code> class with the <code>Security Control</code> and/or <code>Network Proxy</code> profile instead.",
"since": "1.0.0"
},
"profiles": [
"host",
"network_proxy"
],
"attributes": {
"activity_id": {
"enum": {
"1": {
"caption": "Access Grant",
"description": "The incoming request has permission to the web resource."
},
"2": {
"caption": "Access Deny",
"description": "The incoming request does not have permission to the web resource."
},
"3": {
"caption": "Access Revoke",
"description": "The incoming request's access has been revoked due to security policy enforcements."
},
"4": {
"caption": "Access Error",
"description": "An error occurred during processing the request."
},
"0": {
"caption": "Unknown",
"description": "The event activity is unknown."
},
"99": {
"caption": "Other",
"description": "The event activity is not mapped. See the <code>activity_name</code> attribute, which contains a data source specific value."
}
},
"requirement": "required",
"caption": "Activity ID",
"description": "The normalized identifier of the activity that triggered the event.",
"sibling": "activity_name",
"type": "integer_t"
},
"http_request": {
"description": "Details about the underlying HTTP request.",
"group": "context",
"requirement": "required",
"caption": "HTTP Request",
"type": "http_request"
},
"http_response": {
"description": "Details about the HTTP response, if available.",
"group": "context",
"requirement": "optional",
"caption": "HTTP Response",
"type": "http_response"
},
"proxy": {
"description": "Details about the proxy service, if available.",
"group": "context",
"requirement": "optional",
"@deprecated": {
"message": "Use the <code> proxy_endpoint </code> attribute instead.",
"since": "1.1.0"
},
"caption": "Proxy",
"type": "network_proxy"
},
"web_resources": {
"description": "Details about the resource that is the target of the activity.",
"group": "primary",
"requirement": "required",
"caption": "Web Resources",
"is_array": true,
"type": "web_resource"
},
"src_endpoint": {
"description": "Details about the source endpoint of the request.",
"group": "primary",
"requirement": "recommended",
"caption": "Source Endpoint",
"type": "network_endpoint"
},
"tls": {
"description": "The Transport Layer Security (TLS) attributes, if available.",
"group": "context",
"requirement": "optional",
"caption": "TLS",
"type": "tls"
},
"proxy_endpoint": {
"description": "The proxy (server) in a network connection.",
"requirement": "optional",
"caption": "Proxy Endpoint",
"type": "network_proxy"
},
"proxy_connection_info": {
"description": "The connection information from the proxy server to the remote server.",
"requirement": "recommended",
"caption": "Proxy Connection Info",
"type": "network_connection_info"
},
"proxy_http_request": {
"description": "The HTTP Request from the proxy server to the remote server.",
"requirement": "optional",
"caption": "Proxy HTTP Request",
"type": "http_request"
},
"proxy_http_response": {
"description": "The HTTP Response from the remote server to the proxy server.",
"requirement": "optional",
"caption": "Proxy HTTP Response",
"type": "http_response"
},
"proxy_traffic": {
"description": "The network traffic refers to the amount of data moving across a network, from proxy to remote server at a given point of time.",
"requirement": "recommended",
"caption": "Proxy Traffic",
"type": "network_traffic"
},
"proxy_tls": {
"description": "The TLS protocol negotiated between the proxy server and the remote server.",
"requirement": "recommended",
"caption": "Proxy TLS",
"type": "tls"
},
"device": {
"requirement": "recommended",
"caption": "Device",
"description": "An addressable device, computer system or host.",
"type": "device",
"@deprecated": {
"since": "1.1.0",
"message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
}
},
"actor": {
"requirement": "optional",
"caption": "Actor",
"description": "The actor object describes details about the user/role/process that was the source of the activity.",
"type": "actor",
"@deprecated": {
"since": "1.1.0",
"message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
}
},
"enrichments": {
"group": "context",
"requirement": "optional",
"caption": "Enrichments",
"description": "The additional information from an external data source, which is associated with the event or a finding. For example add location information for the IP address in the DNS answers:</p><code>[{\"name\": \"answers.ip\", \"value\": \"92.24.47.250\", \"type\": \"location\", \"data\": {\"city\": \"Socotra\", \"continent\": \"Asia\", \"coordinates\": [-25.4153, 17.0743], \"country\": \"YE\", \"desc\": \"Yemen\"}}]</code>",
"is_array": true,
"type": "enrichment"
},
"message": {
"group": "primary",
"requirement": "recommended",
"caption": "Message",
"description": "The description of the event/finding, as defined by the source.",
"type": "string_t"
},
"metadata": {
"group": "context",
"requirement": "required",
"caption": "Metadata",
"description": "The metadata associated with the event or a finding.",
"type": "metadata"
},
"observables": {
"group": "primary",
"requirement": "recommended",
"caption": "Observables",
"description": "The observables associated with the event or a finding.",
"is_array": true,
"type": "observable"
},
"raw_data": {
"group": "context",
"requirement": "optional",
"caption": "Raw Data",
"description": "The event data as received from the event source.",
"type": "json_t"
},
"severity": {
"group": "classification",
"requirement": "optional",
"caption": "Severity",
"description": "The event/finding severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the source.",
"type": "string_t"
},
"severity_id": {
"group": "classification",
"requirement": "required",
"caption": "Severity ID",
"description": "<p>The normalized identifier of the event/finding severity.</p>The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events.",
"enum": {
"99": {
"caption": "Other",
"description": "The event/finding severity is not mapped. See the <code>severity</code> attribute, which contains a data source specific value."
},
"0": {
"caption": "Unknown",
"description": "The event severity is not known."
},
"1": {
"caption": "Informational",
"description": "Informational message. No action required."
},
"2": {
"caption": "Low",
"description": "The user decides if action is needed."
},
"3": {
"caption": "Medium",
"description": "Action is required but the situation is not serious at this time."
},
"4": {
"caption": "High",
"description": "Action is required immediately."
},
"5": {
"caption": "Critical",
"description": "Action is required immediately and the scope is broad."
},
"6": {
"caption": "Fatal",
"description": "An error occurred but it is too late to take remedial action."
}
},
"sibling": "severity",
"type": "integer_t"
},
"status": {
"group": "primary",
"requirement": "recommended",
"caption": "Status",
"description": "The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source.",
"type": "string_t"
},
"status_code": {
"group": "primary",
"requirement": "recommended",
"caption": "Status Code",
"description": "The event status code, as reported by the event source.<br /><br />For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18.",
"type": "string_t"
},
"status_detail": {
"group": "primary",
"requirement": "recommended",
"caption": "Status Details",
"description": "The status details contains additional information about the event/finding outcome.",
"type": "string_t"
},
"status_id": {
"group": "primary",
"requirement": "recommended",
"caption": "Status ID",
"description": "The normalized identifier of the event status.",
"enum": {
"99": {
"caption": "Other",
"description": "The event status is not mapped. See the <code>status</code> attribute, which contains a data source specific value."
},
"0": {
"caption": "Unknown",
"description": "The status is unknown."
},
"1": {
"caption": "Success"
},
"2": {
"caption": "Failure"
}
},
"sibling": "status",
"type": "integer_t"
},
"unmapped": {
"group": "context",
"requirement": "optional",
"caption": "Unmapped Data",
"description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
"type": "unmapped",
"is_array": true
},
"activity_name": {
"requirement": "optional",
"caption": "Activity",
"description": "The event activity name, as defined by the activity_id.",
"type": "string_t"
},
"category_name": {
"requirement": "optional",
"caption": "Category",
"description": "The event category name, as defined by category_uid value.",
"type": "string_t"
},
"category_uid": {
"enum": {
"6": {
"caption": "Application Activity",
"description": "Application Activity events report detailed information about the behavior of applications and services."
}
},
"requirement": "required",
"caption": "Category ID",
"description": "The category unique identifier of the event.",
"sibling": "category_name",
"type": "integer_t"
},
"class_name": {
"requirement": "optional",
"caption": "Class",
"description": "The event class name, as defined by class_uid value.",
"type": "string_t"
},
"class_uid": {
"enum": {
"6004": {
"caption": "Web Resource Access Activity",
"description": "Web Resource Access Activity events describe successful/failed attempts to access a web resource over HTTP."
}
},
"requirement": "required",
"caption": "Class ID",
"description": "The unique identifier of a class. A class describes the attributes available in an event.",
"sibling": "class_name",
"type": "integer_t"
},
"type_name": {
"requirement": "optional",
"caption": "Type Name",
"description": "The event/finding type name, as defined by the type_uid.",
"type": "string_t"
},
"type_uid": {
"requirement": "required",
"caption": "Type ID",
"description": "The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: <code>class_uid * 100 + activity_id</code>.",
"sibling": "type_name",
"type": "long_t",
"enum": {
"600401": {
"caption": "Web Resource Access Activity: Access Grant"
},
"600402": {
"caption": "Web Resource Access Activity: Access Deny"
},
"600403": {
"caption": "Web Resource Access Activity: Access Revoke"
},
"600404": {
"caption": "Web Resource Access Activity: Access Error"
},
"600400": {
"caption": "Web Resource Access Activity: Unknown"
},
"600499": {
"caption": "Web Resource Access Activity: Other"
}
}
},
"count": {
"requirement": "optional",
"caption": "Count",
"description": "The number of times that events in the same logical group occurred during the event <strong>Start Time</strong> to <strong>End Time</strong> period.",
"type": "integer_t",
"default": 1
},
"duration": {
"requirement": "optional",
"caption": "Duration",
"description": "The event duration or aggregate time, the amount of time the event covers from <code>start_time</code> to <code>end_time</code> in milliseconds.",
"type": "integer_t"
},
"end_time": {
"description": "The end time of a time period, or the time of the most recent event included in the aggregate event.",
"requirement": "optional",
"caption": "End Time",
"type": "timestamp_t"
},
"start_time": {
"description": "The start time of a time period, or the time of the least recent event included in the aggregate event.",
"requirement": "optional",
"caption": "Start Time",
"type": "timestamp_t"
},
"time": {
"requirement": "required",
"caption": "Event Time",
"description": "The normalized event occurrence time or the finding creation time.",
"type": "timestamp_t"
},
"timezone_offset": {
"requirement": "recommended",
"caption": "Timezone Offset",
"description": "The number of minutes that the reported event <code>time</code> is ahead or behind UTC, in the range -1,080 to +1,080.",
"type": "integer_t"
},
"cloud": {
"requirement": "required",
"group": "primary",
"caption": "Cloud",
"description": "Describes details about the Cloud environment where the event was originally created or logged.",
"type": "cloud"
},
"api": {
"requirement": "optional",
"group": "context",
"caption": "API Details",
"description": "Describes details about a typical API (Application Programming Interface) call.",
"type": "api"
},
"data": {
"description": "Additional data that is associated with the event.",
"requirement": "optional",
"caption": "Data",
"type": "json_t",
"@deprecated": {
"since": "1.1.0",
"message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
}
},
"confidence": {
"group": "classification",
"requirement": "optional",
"caption": "Confidence",
"description": "The confidence of the reported event severity as a percentage: 0%-100%.",
"type": "integer_t",
"@deprecated": {
"since": "1.1.0",
"message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
}
},
"record_id": {
"description": "Unique idenifier for the event",
"group": "primary",
"requirement": "required",
"caption": "Record ID",
"type": "string_t"
}
}
}