User

JSON

            
{
  "caption": "User",
  "description": "The user object describes the identity of a user.",
  "extends": [
    null,
    "user"
  ],
  "name": "user",
  "observable": 21,
  "attributes": {
    "account": {
      "description": "The user's account or the account associated with the user.",
      "requirement": "optional",
      "caption": "Account",
      "type": "account"
    },
    "credential_uid": {
      "requirement": "optional",
      "caption": "User Credential ID",
      "description": "The unique identifier of the user's credential. For example, AWS Access Key ID.",
      "type": "string_t",
      "observable": 19
    },
    "domain": {
      "description": "The domain where the user is defined. For example: the LDAP or Active Directory domain.",
      "requirement": "required",
      "caption": "Domain",
      "type": "string_t"
    },
    "email_addr": {
      "requirement": "optional",
      "caption": "Email Address",
      "description": "The user's primary email address.",
      "type": "email_t"
    },
    "full_name": {
      "requirement": "optional",
      "caption": "Full Name",
      "description": "The full name of the person, as per the LDAP Common Name attribute (cn).",
      "type": "string_t"
    },
    "groups": {
      "description": "The administrative groups to which the user belongs.",
      "requirement": "optional",
      "caption": "Groups",
      "type": "group",
      "is_array": true
    },
    "has_mfa": {
      "requirement": "recommended",
      "caption": "MFA Assigned",
      "description": "The user has a multi-factor or secondary-factor device assigned.",
      "type": "boolean_t"
    },
    "ldap_person": {
      "description": "The additional LDAP attributes that describe a person.",
      "requirement": "optional",
      "caption": "LDAP Person",
      "type": "ldap_person"
    },
    "name": {
      "description": "The username. For example, <code>janedoe1</code>.",
      "requirement": "recommended",
      "type": "string_t",
      "caption": "Name",
      "name": "username_t"
    },
    "org": {
      "description": "Organization and org unit related to the user.",
      "requirement": "optional",
      "caption": "Organization",
      "type": "organization"
    },
    "phone_number": {
      "caption": "Telephone Number",
      "description": "The telephone number of the user.",
      "requirement": "optional",
      "type": "string_t"
    },
    "risk_level": {
      "requirement": "optional",
      "caption": "Risk Level",
      "description": "The risk level, normalized to the caption of the risk_level_id value.",
      "type": "string_t"
    },
    "risk_level_id": {
      "requirement": "optional",
      "caption": "Risk Level ID",
      "description": "The normalized risk level id.",
      "sibling": "risk_level",
      "type": "integer_t",
      "enum": {
        "0": {
          "caption": "Info"
        },
        "1": {
          "caption": "Low"
        },
        "2": {
          "caption": "Medium"
        },
        "3": {
          "caption": "High"
        },
        "4": {
          "caption": "Critical"
        },
        "99": {
          "caption": "Other",
          "description": "The risk level is not mapped. See the <code>risk_level</code> attribute, which contains a data source specific value."
        }
      }
    },
    "risk_score": {
      "requirement": "optional",
      "caption": "Risk Score",
      "description": "The risk score as reported by the event source.",
      "type": "integer_t"
    },
    "type": {
      "description": "The type of the user. For example, System, AWS IAM User, etc.",
      "requirement": "optional",
      "caption": "Type",
      "type": "string_t"
    },
    "type_id": {
      "description": "The account type identifier.",
      "enum": {
        "0": {
          "caption": "Unknown",
          "description": "The type is unknown."
        },
        "1": {
          "caption": "User",
          "description": "Regular user account."
        },
        "2": {
          "caption": "Admin",
          "description": "Admin/root user account."
        },
        "3": {
          "caption": "System",
          "description": "System account. For example, Windows computer accounts with a trailing dollar sign ($)."
        },
        "99": {
          "caption": "Other",
          "description": "The type is not mapped. See the <code>type</code> attribute, which contains a data source specific value."
        }
      },
      "requirement": "recommended",
      "caption": "Type ID",
      "sibling": "type",
      "type": "integer_t",
      "name": "integer_t",
      "default": 0
    },
    "uid": {
      "description": "The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN.",
      "requirement": "recommended",
      "observable": 31,
      "caption": "Unique ID",
      "type": "string_t"
    },
    "uid_alt": {
      "description": "The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID.",
      "requirement": "optional",
      "caption": "Alternate ID",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    },
    "uuid": {
      "description": "The universally unique identifier of the user. For example, AWS ARN or Windows user GUID.",
      "caption": "Unique User ID",
      "requirement": "optional",
      "type": "string_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "org_uid": {
      "requirement": "optional",
      "caption": "Org ID",
      "description": "The unique identifier of the organization to which the user belongs. For example, Active Directory or AWS Org ID.",
      "type": "string_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "account_uid": {
      "requirement": "optional",
      "caption": "Account UID",
      "description": "The unique identifier of the account(e.g. AWS Account ID).",
      "type": "string_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "account_type_id": {
      "requirement": "optional",
      "caption": "Account Type ID",
      "description": "The normalized user account type identifier.",
      "enum": {
        "-1": {
          "caption": "Other",
          "description": "The user account type is not mapped."
        },
        "0": {
          "caption": "Unknown",
          "description": "The user account type is unknown."
        },
        "1": {
          "caption": "LDAP Account"
        },
        "2": {
          "caption": "Windows Account"
        },
        "3": {
          "caption": "AWS IAM Account"
        },
        "4": {
          "caption": "GCP Account"
        },
        "5": {
          "caption": "Azure AD Account"
        }
      },
      "sibling": "account_type",
      "type": "integer_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "session_uuid": {
      "requirement": "optional",
      "caption": "Session UUID",
      "description": "The universally unique ID of the user session, as reported by the OS. For example, in Windows this is the Login GUID.",
      "type": "string_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "account_type": {
      "requirement": "optional",
      "caption": "Account Type",
      "description": "The user account type, as defined by the event source.",
      "type": "string_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "session_uid": {
      "requirement": "optional",
      "caption": "Session UID",
      "description": "The unique ID of the user session, as reported by the OS.<br /><br /><u>Examples:</u> <ul><li><i><b>*nix: </b><i>Aug 10 17:31:16 ip-192-168-1-1 systemd[1]: Started Session 222 of User ubuntu.</li><ul><li><b>session_uid</b> == 222</li></ul><li><b>Windows:</b> Logon ID:       0xd22e9734</li><ul><li><b>session_uid</b> == 0xd22e9734</li></ul></ul>",
      "type": "string_t",
      "@deprecated": {
        "since": "1.1.0",
        "message": "Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0"
      }
    },
    "devices": {
      "description": "The devices related to user.",
      "requirement": "optional",
      "caption": "Devices",
      "type": "device",
      "is_array": true
    },
    "last_login_time": {
      "requirement": "optional",
      "caption": "Last Login",
      "description": "The last time when the user logged in.",
      "type": "timestamp_t"
    }
  },
  "constraints": {
    "at_least_one": [
      "account",
      "name",
      "uid"
    ]
  }
}