Windows Resource

win_resource

The Windows resource object describes a resource object managed by Windows, such as mutant or timer.

Contents

Attributes

Caption Name Type Is Array Default Description
Data data JSON Additional data describing the resource.
Data Classification data_classification Data Classification The Data Classification object includes information about data classification levels and data category types.
Details details String The string detailing the attributes of the resource object.
Labels labels String The list of labels/tags associated to a resource.
Name name String The name of the resource object.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Service Name svc_name String The Windows service acting as the object server for the resource object, such as Security or Security Account Manager.
Type type String The type of the Windows resource object.
Type ID type_id Integer The normalized type identifier of the Windows resource object accessed.
0
Unknown
1
Directory
2
Event
3
Timer
4
Device
5
Mutant
6
Type
7
File
8
Token
9
Thread
10
Section
11
WindowStation
12
DebugObject
13
FilterCommunicationPort
14
EventPair
15
Driver
16
IoCompletion
17
Controller
18
SymbolicLink
19
WmiGuid
20
Process
21
Profile
22
Desktop
23
KeyedEvent
24
Adapter
25
Key
26
WaitablePort
27
Callback
28
Semaphore
29
Job
30
Port
31
FilterConnectionPort
32
ALPC Port
33
SAM_ALIAS
34
SAM_GROUP
35
SAM_USER
36
SAM_DOMAIN
37
SAM_SERVER
99
Other
Unique ID uid String The Windows provided handle identifier for the resource object
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

Context

Windows Resource

JSON

            
{
  "description": "The Windows resource object describes a resource object managed by Windows, such as mutant or timer.",
  "caption": "Windows Resource",
  "name": "win_resource",
  "extends": "_resource",
  "attributes": {
    "name": {
      "description": "The name of the resource object.",
      "requirement": "recommended",
      "caption": "Name",
      "type": "string_t"
    },
    "details": {
      "description": "The string detailing the attributes of the resource object.",
      "requirement": "optional",
      "caption": "Details",
      "type": "string_t"
    },
    "svc_name": {
      "description": "The Windows service acting as the object server for the resource object, such as Security or Security Account Manager.",
      "requirement": "optional",
      "caption": "Service Name",
      "type": "string_t"
    },
    "type": {
      "description": "The type of the Windows resource object.",
      "requirement": "optional",
      "caption": "Type",
      "type": "string_t"
    },
    "type_id": {
      "description": "The normalized type identifier of the Windows resource object accessed.",
      "enum": {
        "99": {
          "caption": "Other",
          "description": "The resource object type is not mapped. See the <code>type</code> attribute, which may contain a data source specific value."
        },
        "0": {
          "caption": "Unknown",
          "description": "The resource object type is unknown."
        },
        "1": {
          "caption": "Directory"
        },
        "2": {
          "caption": "Event"
        },
        "3": {
          "caption": "Timer"
        },
        "4": {
          "caption": "Device"
        },
        "5": {
          "caption": "Mutant"
        },
        "6": {
          "caption": "Type"
        },
        "7": {
          "caption": "File"
        },
        "8": {
          "caption": "Token"
        },
        "9": {
          "caption": "Thread"
        },
        "10": {
          "caption": "Section"
        },
        "11": {
          "caption": "WindowStation"
        },
        "12": {
          "caption": "DebugObject"
        },
        "13": {
          "caption": "FilterCommunicationPort"
        },
        "14": {
          "caption": "EventPair"
        },
        "15": {
          "caption": "Driver"
        },
        "16": {
          "caption": "IoCompletion"
        },
        "17": {
          "caption": "Controller"
        },
        "18": {
          "caption": "SymbolicLink"
        },
        "19": {
          "caption": "WmiGuid"
        },
        "20": {
          "caption": "Process"
        },
        "21": {
          "caption": "Profile"
        },
        "22": {
          "caption": "Desktop"
        },
        "23": {
          "caption": "KeyedEvent"
        },
        "24": {
          "caption": "Adapter"
        },
        "25": {
          "caption": "Key"
        },
        "26": {
          "caption": "WaitablePort"
        },
        "27": {
          "caption": "Callback"
        },
        "28": {
          "caption": "Semaphore"
        },
        "29": {
          "caption": "Job"
        },
        "30": {
          "caption": "Port"
        },
        "31": {
          "caption": "FilterConnectionPort"
        },
        "32": {
          "caption": "ALPC Port"
        },
        "33": {
          "caption": "SAM_ALIAS"
        },
        "34": {
          "caption": "SAM_GROUP"
        },
        "35": {
          "caption": "SAM_USER"
        },
        "36": {
          "caption": "SAM_DOMAIN"
        },
        "37": {
          "caption": "SAM_SERVER"
        }
      },
      "sibling": "type",
      "requirement": "required",
      "type": "integer_t",
      "caption": "Type ID"
    },
    "uid": {
      "description": "The Windows provided handle identifier for the resource object",
      "requirement": "recommended",
      "caption": "Unique ID",
      "type": "string_t"
    },
    "$include": [
      "profiles/data_classification.json"
    ],
    "data": {
      "description": "Additional data describing the resource.",
      "requirement": "optional",
      "caption": "Data",
      "type": "json_t"
    },
    "labels": {
      "description": "The list of labels/tags associated to a resource.",
      "requirement": "optional",
      "caption": "Labels",
      "type": "string_t",
      "is_array": true
    },
    "data_classification": {
      "group": "context",
      "requirement": "recommended",
      "caption": "Data Classification",
      "description": "The Data Classification object includes information about data classification levels and data category types.",
      "type": "data_classification"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  },
  "profiles": [
    "data_classification"
  ],
  "constraints": {
    "at_least_one": [
      "name",
      "uid"
    ]
  },
  "extension": "windows"
}