Network Interface

network_interface

The Network Interface object describes the type and associated attributes of a network interface.

Contents

Attributes

Caption Name Type Is Array Default Description
Hostname hostname Hostname The hostname associated with the network interface.
IP Address ip IP Address The IP address associated with the network interface.
MAC Address mac MAC Address The MAC address of the network interface.
Name name String The name of the network interface.
Namespace namespace String The namespace is useful in merger or acquisition situations. For example, when similar entities exist that you need to keep separate.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Reputation Scores reputation Reputation Contains the original and normalized reputation scores.

Deprecated since 1.1.0: Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0
Subnet Prefix Length subnet_prefix Integer The subnet prefix length determines the number of bits used to represent the network part of the IP address. The remaining bits are reserved for identifying individual hosts within that subnet.
Type type String The type of network interface.
Type ID type_id Integer 0 The network interface type identifier.
0
Unknown
1
Wired
2
Wireless
3
Mobile
4
Tunnel
99
Other
Unique ID uid String The unique identifier for the network interface.
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

Context

Network Interface

JSON

            
{
  "caption": "Network Interface",
  "description": "The Network Interface object describes the type and associated attributes of a network interface.",
  "extends": "_entity",
  "name": "network_interface",
  "attributes": {
    "hostname": {
      "description": "The hostname associated with the network interface.",
      "requirement": "recommended",
      "caption": "Hostname",
      "type": "hostname_t"
    },
    "ip": {
      "description": "The IP address associated with the network interface.",
      "requirement": "recommended",
      "caption": "IP Address",
      "type": "ip_t"
    },
    "mac": {
      "description": "The MAC address of the network interface.",
      "requirement": "recommended",
      "caption": "MAC Address",
      "type": "mac_t"
    },
    "name": {
      "description": "The name of the network interface.",
      "requirement": "recommended",
      "caption": "Name",
      "type": "string_t"
    },
    "namespace": {
      "requirement": "optional",
      "caption": "Namespace",
      "description": "The namespace is useful in merger or acquisition situations. For example, when similar entities exist that you need to keep separate.",
      "type": "string_t"
    },
    "subnet_prefix": {
      "requirement": "optional",
      "caption": "Subnet Prefix Length",
      "description": "The subnet prefix length determines the number of bits used to represent the network part of the IP address. The remaining bits are reserved for identifying individual hosts within that subnet.",
      "type": "integer_t"
    },
    "type": {
      "description": "The type of network interface.",
      "requirement": "optional",
      "caption": "Type",
      "type": "string_t"
    },
    "type_id": {
      "description": "The network interface type identifier.",
      "enum": {
        "0": {
          "caption": "Unknown",
          "description": "The type is unknown."
        },
        "1": {
          "caption": "Wired"
        },
        "2": {
          "caption": "Wireless"
        },
        "3": {
          "caption": "Mobile"
        },
        "4": {
          "caption": "Tunnel"
        },
        "99": {
          "caption": "Other",
          "description": "The type is not mapped. See the <code>type</code> attribute, which contains a data source specific value."
        }
      },
      "requirement": "required",
      "caption": "Type ID",
      "sibling": "type",
      "type": "integer_t",
      "default": 0
    },
    "uid": {
      "description": "The unique identifier for the network interface.",
      "requirement": "optional",
      "caption": "Unique ID",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    },
    "reputation": {
      "requirement": "optional",
      "caption": "Reputation Scores",
      "description": "Contains the original and normalized reputation scores.",
      "type": "reputation",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    }
  },
  "constraints": {
    "at_least_one": [
      "ip",
      "mac",
      "name",
      "hostname"
    ]
  }
}