DCE/RPC

dce_rpc

The DCE/RPC, or Distributed Computing Environment/Remote Procedure Call, object describes the remote procedure call system for distributed computing environments. Defined by D3FEND d3f:RemoteProcedureCall.

Contents

Attributes

Caption Name Type Is Array Default Description
Command command String The request command (e.g. REQUEST, BIND).
Command Response command_response String The reply to the request command (e.g. RESPONSE, BINDACK or FAULT).
Flags flags String The list of interface flags.
Network Interfaces network_interfaces Network Interface The list of DCE/RPC interfaces

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0
Opnum opnum Integer An operation number used to identify a specific remote procedure call (RPC) method or a method in an interface.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Remote Procedure Call Interface rpc_interface RPC Interface The RPC Interface object describes the details pertaining to the remote procedure call interface.
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

Context

DCE/RPC

JSON

            
{
  "caption": "DCE/RPC",
  "name": "dce_rpc",
  "description": "The DCE/RPC, or Distributed Computing Environment/Remote Procedure Call, object describes the remote procedure call system for distributed computing environments. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:RemoteProcedureCall/'>d3f:RemoteProcedureCall</a>.",
  "extends": "object",
  "attributes": {
    "command": {
      "description": "The request command (e.g. REQUEST, BIND).",
      "requirement": "recommended",
      "caption": "Command",
      "type": "string_t"
    },
    "command_response": {
      "description": "The reply to the request command (e.g. RESPONSE, BINDACK or FAULT).",
      "requirement": "recommended",
      "caption": "Command Response",
      "type": "string_t"
    },
    "flags": {
      "description": "The list of interface flags.",
      "requirement": "required",
      "caption": "Flags",
      "type": "string_t",
      "is_array": true
    },
    "rpc_interface": {
      "requirement": "required",
      "caption": "Remote Procedure Call Interface",
      "description": "The RPC Interface object describes the details pertaining to the remote procedure call interface.",
      "type": "rpc_interface"
    },
    "opnum": {
      "requirement": "recommended",
      "caption": "Opnum",
      "description": "An operation number used to identify a specific remote procedure call (RPC) method or a method in an interface.",
      "type": "integer_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    },
    "network_interfaces": {
      "description": "The list of DCE/RPC interfaces",
      "requirement": "required",
      "caption": "Network Interfaces",
      "is_array": true,
      "type": "network_interface",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    }
  }
}