Operating System (OS)

JSON

            
{
  "caption": "Operating System (OS)",
  "description": "The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows. Defined by D3FEND <a target='_blank' href='https://d3fend.mitre.org/dao/artifact/d3f:OperatingSystem/'>d3f:OperatingSystem</a>.",
  "extends": "object",
  "name": "os",
  "attributes": {
    "build": {
      "requirement": "optional",
      "caption": "OS Build",
      "description": "The operating system build number.",
      "type": "string_t"
    },
    "country": {
      "description": "The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code). For the complete list of country codes, see <a target='_blank' href='https://www.iso.org/obp/ui/#iso:pub:PUB500001:en'>ISO 3166-1 alpha-2 codes</a>.",
      "requirement": "optional",
      "observable": 14,
      "caption": "Country",
      "type": "string_t"
    },
    "cpe_name": {
      "requirement": "optional",
      "caption": "The product CPE identifier",
      "description": "The Common Platform Enumeration (CPE) name as described by (<a target='_blank' href='https://nvd.nist.gov/products/cpe'>NIST</a>) For example: <code>cpe:/a:apple:safari:16.2</code>.",
      "type": "string_t"
    },
    "cpu_bits": {
      "requirement": "optional",
      "caption": "CPU Bits",
      "description": "The cpu architecture, the number of bits used for addressing in memory. For example: <code>32</code> or <code>64</code>.",
      "type": "integer_t"
    },
    "edition": {
      "requirement": "optional",
      "caption": "OS Edition",
      "description": "The operating system edition. For example: <code>Professional</code>.",
      "type": "string_t"
    },
    "lang": {
      "requirement": "optional",
      "caption": "Language",
      "description": "The two letter lower case language codes, as defined by <a target='_blank' href='https://en.wikipedia.org/wiki/ISO_639-1'>ISO 639-1</a>. For example: <code>en</code> (English), <code>de</code> (German), or <code>fr</code> (French).",
      "type": "string_t"
    },
    "name": {
      "description": "The operating system name.",
      "requirement": "required",
      "caption": "Name",
      "type": "string_t"
    },
    "sp_name": {
      "requirement": "optional",
      "caption": "OS Service Pack",
      "description": "The name of the latest Service Pack.",
      "type": "string_t"
    },
    "sp_ver": {
      "requirement": "optional",
      "caption": "OS Service Pack Version",
      "description": "The version number of the latest Service Pack.",
      "type": "integer_t"
    },
    "type": {
      "description": "The type of the operating system.",
      "requirement": "optional",
      "caption": "Type",
      "type": "string_t"
    },
    "type_id": {
      "description": "The type identifier of the operating system.",
      "requirement": "required",
      "enum": {
        "100": {
          "caption": "Windows"
        },
        "101": {
          "caption": "Windows Mobile"
        },
        "200": {
          "caption": "Linux"
        },
        "201": {
          "caption": "Android"
        },
        "300": {
          "caption": "macOS"
        },
        "301": {
          "caption": "iOS"
        },
        "302": {
          "caption": "iPadOS"
        },
        "400": {
          "caption": "Solaris"
        },
        "401": {
          "caption": "AIX"
        },
        "402": {
          "caption": "HP-UX"
        },
        "0": {
          "caption": "Unknown",
          "description": "The type is unknown."
        },
        "99": {
          "caption": "Other",
          "description": "The type is not mapped. See the <code>type</code> attribute, which contains a data source specific value."
        }
      },
      "caption": "Type ID",
      "sibling": "type",
      "type": "integer_t",
      "default": 0
    },
    "version": {
      "description": "The version of the OS running on the device that originated the event. For example: \"Windows 10\", \"OS X 10.7\", or \"iOS 9\".",
      "requirement": "optional",
      "caption": "Version",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  }
}