Related Event

related_event

The Related Event object describes an OCSF event related to a finding.

Contents

Attributes

Caption Name Type Is Array Default Description
MITRE ATT&CK® Details attacks MITRE ATT&CK® An array of MITRE ATT&CK® objects describing the tactics, techniques & sub-techniques identified by a security control or finding.
Kill Chain kill_chain Kill Chain Phase The Cyber Kill Chain® provides a detailed description of each phase and its associated activities within the broader context of a cyber attack.
Observables observables Observable The observables associated with the event or a finding.
Product Identifier product_uid String The unique identifier of the product that reported the related event.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Type type String The type of the related event, as defined by type_uid.

For example: Process Activity: Launch.

Deprecated since 1.2.0: Use type_name attribute instead.
Type Name type_name String The type of the related OCSF event, as defined by type_uid.

For example: Process Activity: Launch.
Type ID type_uid Long The unique identifier of the related OCSF event type.

For example: 100701.
Unique ID uid String The unique identifier of the related OCSF event. This value must be equal to metadata.uid in the corresponding related event.
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

Context

Related Event

JSON

            
{
  "caption": "Related Event",
  "description": "The Related Event object describes an OCSF event related to a finding.",
  "extends": "object",
  "name": "related_event",
  "attributes": {
    "attacks": {
      "requirement": "optional",
      "caption": "MITRE ATT&CK\u00ae Details",
      "description": "An array of <a target='_blank' href='https://attack.mitre.org'>MITRE ATT&CK\u00ae</a> objects describing the tactics, techniques & sub-techniques identified by a security control or finding.",
      "type": "attack",
      "is_array": true
    },
    "kill_chain": {
      "requirement": "optional",
      "caption": "Kill Chain",
      "description": "The <a target='_blank' href='https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html'>Cyber Kill Chain\u00ae</a> provides a detailed description of each phase and its associated activities within the broader context of a cyber attack.",
      "type": "kill_chain_phase",
      "is_array": true
    },
    "observables": {
      "requirement": "optional",
      "caption": "Observables",
      "description": "The observables associated with the event or a finding.",
      "type": "observable",
      "is_array": true
    },
    "product_uid": {
      "description": "The unique identifier of the product that reported the related event.",
      "requirement": "optional",
      "caption": "Product Identifier",
      "type": "string_t"
    },
    "type": {
      "@deprecated": {
        "message": "Use <code>type_name</code> attribute instead.",
        "since": "1.2.0"
      },
      "description": "The type of the related event, as defined by <code>type_uid</code>. <p>For example: <code>Process Activity: Launch.</code></p>",
      "requirement": "optional",
      "caption": "Type",
      "type": "string_t"
    },
    "type_name": {
      "description": "The type of the related OCSF event, as defined by <code>type_uid</code>. <p>For example: <code>Process Activity: Launch.</code></p>",
      "requirement": "optional",
      "caption": "Type Name",
      "type": "string_t"
    },
    "type_uid": {
      "description": "The unique identifier of the related OCSF event type. <p>For example: <code>100701.</code></p>",
      "requirement": "recommended",
      "caption": "Type ID",
      "sibling": "type_name",
      "type": "long_t"
    },
    "uid": {
      "description": "The unique identifier of the related OCSF event. This value must be equal to <code>metadata.uid</code> in the corresponding related event.",
      "requirement": "required",
      "caption": "Unique ID",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  }
}