OCSF Discovery Schema

The Discovery class captures device and service discovery events, including asset inventory data, network scanning results, service enumeration, device profiling, and configuration discovery from various sources. This schema is part of the OCSF (Open Cybersecurity Schema Framework) standard. For general OCSF guidance and field naming conventions, see OCSF Schema Overview.

For more information on the OCSF Version 1.2 standard, see OCSF v1.2 Documentation.

Field Description Value Type
action Optional: The normalized caption of 'action_id' or the source-specific action. string
action_id Required: The normalized action taken by a control or other policy-based system leading to an outcome or disposition. integer
activity_id Required: The normalized identifier of the activity that triggered the event. integer
activity_name Optional: The event activity name, as defined by the activity_id. string
actor Optional: The actor object describes details about the user/role/process that was the source of the activity. object
actor.app_uid Optional: The unique identifier of the client application or service that initiated the activity. string
actor.idp Optional: This object describes details about the Identity Provider used. object
actor.idp.name Recommended: The name of the identity provider. string
actor.idp.uid Recommended: The unique identifier of the identity provider. string
actor.invoked_by Optional: The name of the service that invoked the activity as described in the event. string
actor.process Recommended: The process that initiated the activity. object
actor.process.cmd_line Recommended: The full command line used to launch an application, service, process, or job. string
actor.process.container Recommended: The information describing an instance of a container. object
actor.process.container.hash Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e... object
actor.process.container.hash.algorithm Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. string
actor.process.container.hash.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
actor.process.container.hash.value Required: The digital fingerprint value. string
actor.process.container.image Recommended: The container image used as a template to run the container. object
actor.process.container.image.name Recommended: The image name. For example: elixir. string
actor.process.container.image.uid Required: The unique image ID. For example: 77af4d6b9913. string
actor.process.container.name Recommended: The container name. string
actor.process.container.size Recommended: The size of the container image. long
actor.process.container.uid Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff35.... string
actor.process.created_time Recommended: The time when the process was created/started. long
actor.process.file Recommended: The process file object. object
actor.process.file.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
actor.process.file.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
actor.process.file.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
actor.process.file.hashes Recommended: An array of hash attributes. array of objects
actor.process.file.hashes.algorithm Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. string
actor.process.file.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
actor.process.file.hashes.value Required: The digital fingerprint value. string
actor.process.file.name Required: The name of the file. For example: svchost.exe string
actor.process.file.parent_folder Optional: The parent folder in which the file resides. string
actor.process.file.path Recommended: The full path to the file. string
actor.process.file.size Optional: The size of data, in bytes. long
actor.process.file.type Optional: The file type. string
actor.process.file.type_id Required: The file type ID. integer
actor.process.integrity Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). string
actor.process.integrity_id Optional: The normalized identifier of the process integrity level (Windows only). integer
actor.process.name Recommended: The friendly name of the process, for example: Notepad++. string
actor.process.namespace_pid Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. integer
actor.process.parent_process Recommended: The parent process of this process object. object
actor.process.parent_process.cmd_line Recommended: The full command line used to launch an application, service, process, or job. string
actor.process.parent_process.container Recommended: The information describing an instance of a container. object
actor.process.parent_process.container.hash Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b4.... object
actor.process.parent_process.container.hash.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
actor.process.parent_process.container.hash.value Required: The digital fingerprint value. string
actor.process.parent_process.container.image Recommended: The container image used as a template to run the container. object
actor.process.parent_process.container.image.name Recommended: The image name. For example: elixir. string
actor.process.parent_process.container.image.uid Required: The unique image ID. For example: 77af4d6b9913. string
actor.process.parent_process.container.name Recommended: The container name. string
actor.process.parent_process.container.size Recommended: The size of the container image. long
actor.process.parent_process.container.uid Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0df.... string
actor.process.parent_process.created_time Recommended: The time when the process was created/started. long
actor.process.parent_process.file Recommended: The process file object. object
actor.process.parent_process.file.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
actor.process.parent_process.file.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
actor.process.parent_process.file.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
actor.process.parent_process.file.hashes Recommended: An array of hash attributes. array of objects
actor.process.parent_process.file.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
actor.process.parent_process.file.hashes.value Required: The digital fingerprint value. string
actor.process.parent_process.file.name Required: The name of the file. For example: svchost.exe string
actor.process.parent_process.file.path Recommended: The full path to the file. . string
actor.process.parent_process.file.type Optional: The file type. string
actor.process.parent_process.file.type_id Required: The file type ID. integer
actor.process.parent_process.integrity Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). string
actor.process.parent_process.integrity_id Optional: The normalized identifier of the process integrity level (Windows only). integer
actor.process.parent_process.name Recommended: The friendly name of the process, for example: Notepad++. string
actor.process.parent_process.namespace_pid Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. integer
actor.process.parent_process.parent_process Recommended: The parent process of this process object. object
actor.process.parent_process.parent_process.cmd_line Recommended: The full command line used to launch an application, service, process, or job. string
actor.process.parent_process.parent_process.container Recommended: The information describing an instance of a container. object
actor.process.parent_process.parent_process.container.hash Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b4.... object
actor.process.parent_process.parent_process.container.hash.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
actor.process.parent_process.parent_process.container.hash.value Required: The digital fingerprint value. string
actor.process.parent_process.parent_process.container.image Recommended: The container image used as a template to run the container. object
actor.process.parent_process.parent_process.container.image.name Recommended: The image name. For example: elixir. string
actor.process.parent_process.parent_process.container.image.uid Required: The unique image ID. For example: 77af4d6b9913. string
actor.process.parent_process.parent_process.container.name Recommended: The container name. string
actor.process.parent_process.parent_process.container.size Recommended: The size of the container image. long
actor.process.parent_process.parent_process.container.uid Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... string
actor.process.parent_process.parent_process.created_time Recommended: The time when the process was created/started. long
actor.process.parent_process.parent_process.file Recommended: The process file object. object
actor.process.parent_process.parent_process.file.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
actor.process.parent_process.parent_process.file.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
actor.process.parent_process.parent_process.file.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
actor.process.parent_process.parent_process.file.hashes Recommended: An array of hash attributes. array of objects
actor.process.parent_process.parent_process.file.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
actor.process.parent_process.parent_process.file.hashes.value Required: The digital fingerprint value. string
actor.process.parent_process.parent_process.file.name Required: The name of the file. For example: svchost.exe string
actor.process.parent_process.parent_process.file.path Recommended: The full path to the file. . string
actor.process.parent_process.parent_process.file.type_id Required: The file type ID. integer
actor.process.parent_process.parent_process.name Recommended: The friendly name of the process, for example: Notepad++. string
actor.process.parent_process.parent_process.namespace_pid Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. integer
actor.process.parent_process.parent_process.pid Recommended: The process identifier, as reported by the operating system. integer
actor.process.parent_process.parent_process.uid Recommended: A unique identifier for this process assigned by the producer (tool). string
actor.process.parent_process.parent_process.user Recommended: The user under which this process is running. object
actor.process.parent_process.parent_process.user.name Recommended: The username. For example, janedoe1. string
actor.process.parent_process.parent_process.user.type_id Recommended: The account type identifier. integer
actor.process.parent_process.parent_process.user.uid Recommended: The unique user identifier. string
actor.process.parent_process.pid Recommended: The process identifier, as reported by the operating system. integer
actor.process.parent_process.session Optional: The user session under which this process is running. object
actor.process.parent_process.session.created_time Recommended: The time when the session was created. long
actor.process.parent_process.session.is_remote Recommended: The indication of whether the session is remote. boolean
actor.process.parent_process.session.issuer Recommended: The identifier of the session issuer. string
actor.process.parent_process.session.uid Recommended: The unique identifier of the session. string
actor.process.parent_process.uid Recommended: A unique identifier for this process assigned by the producer (tool). string
actor.process.parent_process.user Recommended: The user under which this process is running. object
actor.process.parent_process.user.domain Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. string
actor.process.parent_process.user.name Recommended: The username. For example, janedoe1. string
actor.process.parent_process.user.type_id Recommended: The account type identifier. integer
actor.process.parent_process.user.uid Recommended: The unique user identifier. string
actor.process.pid Recommended: The process identifier, as reported by the operating system. integer
actor.process.session Optional: The user session under which this process is running. object
actor.process.session.created_time Recommended: The time when the session was created. long
actor.process.session.is_remote Recommended: The indication of whether the session is remote. boolean
actor.process.session.issuer Recommended: The identifier of the session issuer. string
actor.process.session.uid Recommended: The unique identifier of the session. string
actor.process.session.uuid Optional: The universally unique identifier of the session. string
actor.process.uid Recommended: A unique identifier for this process assigned by the producer (tool). string
actor.process.user Recommended: The user under which this process is running. object
actor.process.user.account Optional: The user's account or the account associated with the user. object
actor.process.user.account.name Recommended: The name of the account (For example, GCP Account Name). string
actor.process.user.account.type Optional: The account type, normalized to the caption of 'account_type_id'. string
actor.process.user.account.type_id Recommended: The normalized account type identifier. integer
actor.process.user.account.uid Recommended: The unique identifier of the account (For example, AWS Account ID). string
actor.process.user.domain Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. string
actor.process.user.email_addr Optional: The user's primary email address. string
actor.process.user.full_name Optional: The full name of the person, as per the LDAP Common Name attribute (cn). string
actor.process.user.name Recommended: The username. For example, janedoe1. string
actor.process.user.org Optional: Organization and org unit related to the user. object
actor.process.user.org.name Recommended: The name of the organization. For example, Widget, Inc. string
actor.process.user.org.ou_name Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D string
actor.process.user.org.uid Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. string
actor.process.user.risk_level Optional: The risk level, normalized to the caption of the risk_level_id value. string
actor.process.user.type Optional: The type of the user. For example, System, AWS IAM User, etc. string
actor.process.user.type_id Recommended: The account type identifier. integer
actor.process.user.uid Recommended: The unique user identifier. string
actor.session Optional: The user session from which the activity was initiated. object
actor.session.created_time Recommended: The time when the session was created. long
actor.session.is_remote Recommended: The indication of whether the session is remote. boolean
actor.session.issuer Recommended: The identifier of the session issuer. string
actor.session.uid Recommended: The unique identifier of the session. string
actor.session.uuid Optional: The universally unique identifier of the session. string
actor.user Recommended: The user that initiated the activity or the user context from which the activity was initiated. object
actor.user.account Optional: The user's account or the account associated with the user. object
actor.user.account.name Recommended: The name of the account (For example, GCP Account Name). string
actor.user.account.type Optional: The account type, normalized to the caption of 'account_type_id'. string
actor.user.account.type_id Recommended: The normalized account type identifier. integer
actor.user.account.uid Recommended: The unique identifier of the account (For example, AWS Account ID). string
actor.user.domain Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. string
actor.user.email_addr Optional: The user's primary email address. string
actor.user.full_name Optional: The full name of the person, as per the LDAP Common Name attribute (cn). string
actor.user.name Recommended: The username. For example, janedoe1. string
actor.user.org Optional: Organization and org unit related to the user. object
actor.user.org.name Recommended: The name of the organization. For example, Widget, Inc. string
actor.user.org.ou_name Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D string
actor.user.org.uid Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. string
actor.user.risk_level Optional: The risk level, normalized to the caption of the risk_level_id value. string
actor.user.type Optional: The type of the user. For example, System, AWS IAM User, etc. string
actor.user.type_id Recommended: The account type identifier. integer
actor.user.uid Recommended: The unique user identifier. string
api Optional: Describes details about a typical API (Application Programming Interface) call. object
api.operation Required: Verb/Operation associated with the request string
api.request Recommended: Details pertaining to the API request. object
api.request.uid Required: The unique request identifier. string
api.response Recommended: Details pertaining to the API response. object
api.response.code Recommended: The numeric response sent to a request. integer
api.response.error Recommended: Error Code string
api.response.error_message Recommended: Error Message string
api.response.message Recommended: The description of the event/finding, as defined by the source. string
api.service Optional: The information pertaining to the API service. object
api.service.name Recommended: The name of the service. string
api.service.uid Recommended: The unique identifier of the service. string
api.service.version Recommended: The version of the service. string
category_name Optional: The event category name, as defined by category_uid value. string
category_uid Required: The category unique identifier of the event. integer
cis_benchmark_result Recommended: The CIS benchmark result. object
cis_benchmark_result.name Required: The CIS benchmark name. string
class_name Optional: The event class name, as defined by the class_uid. string
class_uid Required: The unique identifier of a class. integer
cloud Required: Describes details about the Cloud environment where the event was originally created or logged. object
cloud.account Optional: The account object describes details about the account that was the source or target of the activity. object
cloud.account.name Recommended: The name of the account (For example, GCP Account Name). string
cloud.account.type Optional: The account type, normalized to the caption of 'account_type_id'. string
cloud.account.type_id Recommended: The normalized account type identifier. integer
cloud.account.uid Recommended: The unique identifier of the account (For example, AWS Account ID). string
cloud.org Optional: Organization and org unit relevant to the event or object. object
cloud.org.name Recommended: The name of the organization. For example, Widget, Inc. string
cloud.org.ou_name Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D string
cloud.org.uid Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. string
cloud.provider Required: The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. string
cloud.region Recommended: The name of the cloud region, as defined by the cloud provider. string
connection_info Required: The network connection information. object
connection_info.direction Optional: The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. string
connection_info.direction_id Required: The normalized identifier of the direction of the initiated connection, traffic, or email. integer
connection_info.protocol_name Optional: The TCP/IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). For example: tcp or udp. string
connection_info.protocol_num Recommended: The TCP/IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). For example: 6 for TCP and 17 for UDP. integer
connection_info.session Optional: The authenticated user or service session. object
connection_info.session.created_time Recommended: The time when the session was created. long
connection_info.session.is_remote Recommended: The indication of whether the session is remote. boolean
connection_info.session.issuer Recommended: The identifier of the session issuer. string
connection_info.session.uid Recommended: The unique identifier of the session. string
connection_info.session.uuid Optional: The universally unique identifier of the session. string
connection_info.uid Optional: The unique identifier of the connection. string
count Optional: The number of times that events in the same logical group occurred during the event Start Time to End Time period. integer
device Recommended: An addressable device, computer system or host. object
device.container Recommended: The information describing an instance of a container. object
device.container.hash Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5.... object
device.container.hash.algorithm Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. string
device.container.hash.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
device.container.hash.value Required: The digital fingerprint value. string
device.container.image Recommended: The container image used as a template to run the container. object
device.container.image.name Recommended: The image name. For example: elixir. string
device.container.image.uid Required: The unique image ID. For example: 77af4d6b9913. string
device.container.name Recommended: The container name. string
device.container.size Recommended: The size of the container image. long
device.container.uid Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... string
device.domain Optional: The network domain where the device resides. For example: work.example.com. string
device.groups Optional: The group names to which the device belongs. For example: ["Windows Laptops", "Engineering"]. array of objects
device.groups.desc Optional: The group description. string
device.groups.domain Optional: The domain where the group is defined. For example: the LDAP or Active Directory domain. string
device.groups.name Recommended: The group name. string
device.groups.type Optional: The type of the group or account. string
device.groups.uid Recommended: The unique identifier of the group. string
device.hostname Recommended: The device hostname. string
device.instance_uid Recommended: The unique identifier of a VM instance. string
device.interface_name Recommended: The name of the network interface (For example, eth2). string
device.interface_uid Recommended: The unique identifier of the network interface. string
device.ip Recommended: The device IP address, in either IPv4 or IPv6 format. string
device.is_compliant Optional: The event occurred on a compliant device. boolean
device.is_managed Optional: The event occurred on a managed device. boolean
device.name Recommended: The alternate device name, ordinarily as assigned by an administrator. string
device.namespace_pid Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. integer
device.os Optional: The endpoint operating system. object
device.os.name Required: The operating system name. string
device.os.type Optional: The type of the operating system. string
device.os.type_id Required: The type identifier of the operating system. integer
device.owner Recommended: The identity of the service or user account that owns the endpoint or was last logged into it. object
device.owner.account Optional: The user's account or the account associated with the user. object
device.owner.account.name Recommended: The name of the account (For example, GCP Account Name). string
device.owner.account.type Optional: The account type, normalized to the caption of 'account_type_id'. string
device.owner.account.type_id Recommended: The normalized account type identifier. integer
device.owner.account.uid Recommended: The unique identifier of the account (For example, AWS Account ID). string
device.owner.domain Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. string
device.owner.email_addr Optional: The user's primary email address. string
device.owner.full_name Optional: The full name of the person, as per the LDAP Common Name attribute (cn). string
device.owner.name Recommended: The username. For example, janedoe1. string
device.owner.org Optional: Organization and org unit related to the user. object
device.owner.org.name Recommended: The name of the organization. For example, Widget, Inc. string
device.owner.org.ou_name Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D string
device.owner.org.uid Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. string
device.owner.risk_level Optional: The risk level, normalized to the caption of the risk_level_id value. string
device.owner.type Optional: The type of the user. For example, System, AWS IAM User, etc. string
device.owner.type_id Recommended: The account type identifier. integer
device.owner.uid Recommended: The unique user identifier. string
device.region Recommended: The region where the virtual machine is located. For example, an AWS Region. string
device.type Optional: The device type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other. string
device.type_id Required: The device type ID. integer
device.uid Recommended: The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN. string
duration Optional: The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds. integer
end_time Optional: The end time of a time period, or the time of the most recent event included in the aggregate event. long
event_seq_id Required: The sequence identifier for the event. long
event_size Required: The size of the event in bytes. long
event_time Required: The normalized event occurrence time or the finding creation time. long
file Required: The file that is the target of the query. object
file.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
file.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
file.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
file.hashes Recommended: An array of hash attributes. array of objects
file.hashes.algorithm Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. string
file.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
file.hashes.value Required: The digital fingerprint value. string
file.name Required: The name of the file. For example: svchost.exe string
file.parent_folder Optional: The parent folder in which the file resides. string
file.path Recommended: The full path to the file. . string
file.size Optional: The size of data, in bytes. long
file.type Optional: The file type. string
file.type_id Required: The file type ID. integer
folder Required: The folder that is the target of the query. object
folder.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
folder.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
folder.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
folder.hashes Recommended: An array of hash attributes. array of objects
folder.hashes.algorithm Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. string
folder.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
folder.hashes.value Required: The digital fingerprint value. string
folder.name Required: The name of the file. For example: svchost.exe string
folder.parent_folder Optional: The parent folder in which the file resides. string
folder.path Recommended: The full path to the file. . string
folder.size Optional: The size of data, in bytes. long
folder.type Optional: The file type. string
folder.type_id Required: The file type ID. integer
group Required: The administrative group. object
group.desc Optional: The group description. string
group.domain Optional: The domain where the group is defined. For example: the LDAP or Active Directory domain. string
group.name Recommended: The group name. string
group.type Optional: The type of the group or account. string
group.uid Recommended: The unique identifier of the group. string
indexed_time Required: The time when the event was indexed. long
job Required: The job object that pertains to the event. object
job.cmd_line Recommended: The job command line. string
job.created_time Recommended: The time when the job was created. long
job.desc Recommended: The description of the job. string
job.file Required: The file that pertains to the job. object
job.file.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
job.file.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
job.file.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
job.file.hashes Recommended: An array of hash attributes. array of objects
job.file.hashes.algorithm Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. string
job.file.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
job.file.hashes.value Required: The digital fingerprint value. string
job.file.name Required: The name of the file. For example: svchost.exe string
job.file.parent_folder Optional: The parent folder in which the file resides. string
job.file.path Recommended: The full path to the file. . string
job.file.size Optional: The size of data, in bytes. long
job.file.type Optional: The file type. string
job.file.type_id Required: The file type ID. integer
job.last_run_time Recommended: The time when the job was last run. long
job.name Required: The name of the job. string
job.run_state_id Recommended: The run state ID of the job. integer
kb_article_list Recommended: A list of KB articles or patches related to an endpoint. array of objects
kb_article_list.os Recommended: The operating system the kb article applies. object
kb_article_list.os.name Required: The operating system name. string
kb_article_list.os.type Optional: The type of the operating system. string
kb_article_list.os.type_id Required: The type identifier of the operating system. integer
kb_article_list.severity Recommended: The severity of the kb article. string
kb_article_list.title Recommended: The title of the kb article. string
kb_article_list.uid Required: The unique identifier for the kb article. string
kernel Required: The kernel object that pertains to the event. object
kernel.name Required: The name of the kernel resource. string
kernel.type_id Required: The type of the kernel resource. integer
message Recommended: The description of the event/finding, as defined by the source. string
metadata Required: The metadata associated with the event or a finding. object
metadata.correlation_uid Optional: The unique identifier used to correlate events. string
metadata.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
metadata.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
metadata.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
metadata.event_code Optional: The Event ID or Code that the product uses to describe the event. string
metadata.log_level Optional: The audit level at which an event was generated. string
metadata.log_name Recommended: The event log name. For example, syslog file name or Windows logging subsystem: Security. string
metadata.log_provider Recommended: The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing. string
metadata.original_time Recommended: The original event time as reported by the event source. string
metadata.product Required: The product that reported the event. object
metadata.product.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
metadata.product.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
metadata.product.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
metadata.product.feature Optional: The feature that reported the event. object
metadata.product.feature.name Recommended: The name of the feature. string
metadata.product.feature.uid Recommended: The unique identifier of the feature. string
metadata.product.feature.version Recommended: The version of the feature. string
metadata.product.name Recommended: The name of the product. string
metadata.product.uid Recommended: The unique identifier of the product. string
metadata.product.vendor_name Required: The name of the vendor of the product. string
metadata.product.version Recommended: The version of the product, as defined by the event source. For example: 2013.1.3-beta. string
metadata.profiles Optional: The list of profiles used to create the event. array of strings
metadata.sequence Optional: Sequence number of the event. integer
metadata.tenant_uid Recommended: The unique tenant identifier. string
metadata.uid Optional: The logging system-assigned unique identifier of an event instance. string
metadata.version Required: The version of the OCSF schema, using Semantic Versioning Specification. string
module Required: The module that pertains to the event. object
module.base_address Recommended: The memory address where the module was loaded. string
module.file Recommended: The module file object. object
module.file.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
module.file.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
module.file.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
module.file.hashes Recommended: An array of hash attributes. array of objects
module.file.hashes.algorithm Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. string
module.file.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
module.file.hashes.value Required: The digital fingerprint value. string
module.file.name Required: The name of the file. For example: svchost.exe string
module.file.parent_folder Optional: The parent folder in which the file resides. string
module.file.path Recommended: The full path to the file. . string
module.file.size Optional: The size of data, in bytes. long
module.file.type Optional: The file type. string
module.file.type_id Required: The file type ID. integer
module.load_type_id Required: The normalized identifier of the load type. integer
module.start_address Recommended: The start address of the execution. string
module.type Recommended: The module type. string
network_interfaces Required: The network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination.The first element of the array is the network information that pertains to the event. array of objects
network_interfaces.hostname Recommended: The hostname associated with the network interface. string
network_interfaces.ip Recommended: The IP address associated with the network interface. string
network_interfaces.mac Recommended: The MAC address of the network interface. string
network_interfaces.name Recommended: The name of the network interface. string
network_interfaces.type_id Required: The network interface type identifier. integer
observables Recommended: The observables associated with the event or a finding. array of objects
observables.name Required: The full name of the observable attribute. The name is a pointer/reference to an attribute within the event data. For example: file.name. string
observables.type Optional: The observable value type name. string
observables.type_id Required: The observable value type identifier. integer
observables.value Optional: The value associated with the observable attribute. The meaning of the value depends on the observable type. string
original_event_time Required: The original event time from the source system. long
peripheral_device Required: The peripheral device that triggered the event. object
peripheral_device.class Required: The class of the peripheral device. string
peripheral_device.model Recommended: The peripheral device model. string
peripheral_device.name Required: The name of the peripheral device. string
peripheral_device.serial_number Recommended: The peripheral device serial number. string
peripheral_device.uid Recommended: The unique identifier of the peripheral device. string
peripheral_device.vendor_name Recommended: The peripheral device vendor. string
process Required: The process object. object
process.cmd_line Recommended: The full command line used to launch an application, service, process, or job. string
process.container Recommended: The information describing an instance of a container. object
process.container.hash Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2.... object
process.container.hash.algorithm Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. string
process.container.hash.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
process.container.hash.value Required: The digital fingerprint value. string
process.container.image Recommended: The container image used as a template to run the container. object
process.container.image.name Recommended: The image name. For example: elixir. string
process.container.image.uid Required: The unique image ID. For example: 77af4d6b9913. string
process.container.name Recommended: The container name. string
process.container.size Recommended: The size of the container image. long
process.container.uid Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82.... string
process.created_time Recommended: The time when the process was created/started. long
process.file Recommended: The process file object. object
process.file.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
process.file.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
process.file.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
process.file.hashes Recommended: An array of hash attributes. array of objects
process.file.hashes.algorithm Optional: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. string
process.file.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
process.file.hashes.value Required: The digital fingerprint value. string
process.file.name Required: The name of the file. For example: svchost.exe string
process.file.parent_folder Optional: The parent folder in which the file resides. string
process.file.path Recommended: The full path to the file. . string
process.file.size Optional: The size of data, in bytes. long
process.file.type Optional: The file type. string
process.file.type_id Required: The file type ID. integer
process.integrity Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). string
process.integrity_id Optional: The normalized identifier of the process integrity level (Windows only). integer
process.name Recommended: The friendly name of the process, for example: Notepad++. string
process.namespace_pid Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. integer
process.parent_process Recommended: The parent process of this process object. object
process.parent_process.cmd_line Recommended: The full command line used to launch an application, service, process, or job. string
process.parent_process.container Recommended: The information describing an instance of a container. object
process.parent_process.container.hash Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e.... object
process.parent_process.container.hash.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
process.parent_process.container.hash.value Required: The digital fingerprint value. string
process.parent_process.container.image Recommended: The container image used as a template to run the container. object
process.parent_process.container.image.name Recommended: The image name. For example: elixir. string
process.parent_process.container.image.uid Required: The unique image ID. For example: 77af4d6b9913. string
process.parent_process.container.name Recommended: The container name. string
process.parent_process.container.size Recommended: The size of the container image. long
process.parent_process.container.uid Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff.... string
process.parent_process.created_time Recommended: The time when the process was created/started. long
process.parent_process.file Recommended: The process file object. object
process.parent_process.file.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
process.parent_process.file.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
process.parent_process.file.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
process.parent_process.file.hashes Recommended: An array of hash attributes. array of objects
process.parent_process.file.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
process.parent_process.file.hashes.value Required: The digital fingerprint value. string
process.parent_process.file.name Required: The name of the file. For example: svchost.exe string
process.parent_process.file.path Recommended: The full path to the file. . string
process.parent_process.file.type Optional: The file type. string
process.parent_process.file.type_id Required: The file type ID. integer
process.parent_process.integrity Optional: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). string
process.parent_process.integrity_id Optional: The normalized identifier of the process integrity level (Windows only). integer
process.parent_process.name Recommended: The friendly name of the process, for example: Notepad++. string
process.parent_process.namespace_pid Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. integer
process.parent_process.parent_process Recommended: The parent process of this process object. object
process.parent_process.parent_process.cmd_line Recommended: The full command line used to launch an application, service, process, or job. string
process.parent_process.parent_process.container Recommended: The information describing an instance of a container. object
process.parent_process.parent_process.container.hash Recommended: Commit hash of image created for docker or the SHA256 hash of the container. For example: 13550340a8681c84c861aac2e5b.... object
process.parent_process.parent_process.container.hash.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
process.parent_process.parent_process.container.hash.value Required: The digital fingerprint value. string
process.parent_process.parent_process.container.image Recommended: The container image used as a template to run the container. object
process.parent_process.parent_process.container.image.name Recommended: The image name. For example: elixir. string
process.parent_process.parent_process.container.image.uid Required: The unique image ID. For example: 77af4d6b9913. string
process.parent_process.parent_process.container.name Recommended: The container name. string
process.parent_process.parent_process.container.size Recommended: The size of the container image. long
process.parent_process.parent_process.container.uid Recommended: The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3.... string
process.parent_process.parent_process.created_time Recommended: The time when the process was created/started. long
process.parent_process.parent_process.file Recommended: The process file object. object
process.parent_process.parent_process.file.data_classification Recommended: The Data Classification object includes information about data classification levels and data category types. object
process.parent_process.parent_process.file.data_classification.category_id Recommended: The normalized identifier of the data classification category. integer
process.parent_process.parent_process.file.data_classification.confidentiality_id Recommended: The normalized identifier of the file content confidentiality indicator. integer
process.parent_process.parent_process.file.hashes Recommended: An array of hash attributes. array of objects
process.parent_process.parent_process.file.hashes.algorithm_id Required: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. integer
process.parent_process.parent_process.file.hashes.value Required: The digital fingerprint value. string
process.parent_process.parent_process.file.name Required: The name of the file. For example: svchost.exe string
process.parent_process.parent_process.file.path Recommended: The full path to the file. . string
process.parent_process.parent_process.file.type_id Required: The file type ID. integer
process.parent_process.parent_process.name Recommended: The friendly name of the process, for example: Notepad++. string
process.parent_process.parent_process.namespace_pid Recommended: If running under a process namespace (such as in a container), the process identifier within that process namespace. integer
process.parent_process.parent_process.pid Recommended: The process identifier, as reported by the operating system. integer
process.parent_process.parent_process.uid Recommended: A unique identifier for this process assigned by the producer (tool). string
process.parent_process.parent_process.user Recommended: The user under which this process is running. object
process.parent_process.parent_process.user.name Recommended: The username. For example, janedoe1. string
process.parent_process.parent_process.user.type_id Recommended: The account type identifier. integer
process.parent_process.parent_process.user.uid Recommended: The unique user identifier. string
process.parent_process.pid Recommended: The process identifier, as reported by the operating system. integer
process.parent_process.session Optional: The user session under which this process is running. object
process.parent_process.session.created_time Recommended: The time when the session was created. long
process.parent_process.session.is_remote Recommended: The indication of whether the session is remote. boolean
process.parent_process.session.issuer Recommended: The identifier of the session issuer. string
process.parent_process.session.uid Recommended: The unique identifier of the session. string
process.parent_process.uid Recommended: A unique identifier for this process assigned by the producer (tool). string
process.parent_process.user Recommended: The user under which this process is running. object
process.parent_process.user.domain Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. string
process.parent_process.user.name Recommended: The username. For example, janedoe1. string
process.parent_process.user.type_id Recommended: The account type identifier. integer
process.parent_process.user.uid Recommended: The unique user identifier. string
process.pid Recommended: The process identifier, as reported by the operating system. integer
process.session Optional: The user session under which this process is running. object
process.session.created_time Recommended: The time when the session was created. long
process.session.is_remote Recommended: The indication of whether the session is remote. boolean
process.session.issuer Recommended: The identifier of the session issuer. string
process.session.uid Recommended: The unique identifier of the session. string
process.session.uuid Optional: The universally unique identifier of the session. string
process.uid Recommended: A unique identifier for this process assigned by the producer (tool). string
process.user Recommended: The user under which this process is running. object
process.user.account Optional: The user's account or the account associated with the user. object
process.user.account.name Recommended: The name of the account (For example, GCP Account Name). string
process.user.account.type Optional: The account type, normalized to the caption of 'account_type_id'. string
process.user.account.type_id Recommended: The normalized account type identifier. integer
process.user.account.uid Recommended: The unique identifier of the account (For example, AWS Account ID). string
process.user.domain Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. string
process.user.email_addr Optional: The user's primary email address. string
process.user.full_name Optional: The full name of the person, as per the LDAP Common Name attribute (cn). string
process.user.name Recommended: The username. For example, janedoe1. string
process.user.org Optional: Organization and org unit related to the user. object
process.user.org.name Recommended: The name of the organization. For example, Widget, Inc. string
process.user.org.ou_name Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D string
process.user.org.uid Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. string
process.user.risk_level Optional: The risk level, normalized to the caption of the risk_level_id value. string
process.user.type Optional: The type of the user. For example, System, AWS IAM User, etc. string
process.user.type_id Recommended: The account type identifier. integer
process.user.uid Recommended: The unique user identifier. string
query_info Recommended: The search details associated with the query request. object
query_info.name Recommended: The query name for a saved or scheduled query. string
query_info.query_string Required: A string representing the query code being run. string
query_info.uid Recommended: The unique identifier of the query. string
query_result Recommended: The result of the query. string
query_result_id Required: The normalized identifier of the query result. integer
raw_data Optional: The raw event/finding data as received from the source. string
raw_data_size Optional: The size of the raw data which was transformed into an OCSF event, in bytes. long
service Required: The service that pertains to the event. object
service.name Recommended: The name of the service. string
service.uid Recommended: The unique identifier of the service. string
service.version Recommended: The version of the service. string
session Required: The authenticated user or service session. object
session.created_time Recommended: The time when the session was created. long
session.is_remote Recommended: The indication of whether the session is remote. boolean
session.issuer Recommended: The identifier of the session issuer. string
session.uid Recommended: The unique identifier of the session. string
session.uuid Optional: The universally unique identifier of the session. string
severity Optional: The event severity, normalized to the caption of the severity_id value. string
severity_id Required: <p>The normalized identifier of the event/finding severity. integer
start_time Optional: The start time of a time period, or the time of the least recent event included in the aggregate event. long
state Recommended: The state of the socket, normalized to the caption of the state_id value. string
state_id Required: The state of the socket. integer
status Recommended: The event status, normalized to the caption of the status_id value. string
status_code Recommended: The event status code, as reported by the event source. string
status_detail Recommended: The status details contains additional information about the event/finding outcome. string
status_id Recommended: The normalized identifier of the event status. integer
timezone_offset Recommended: The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080. integer
type_name Optional: The event type name, as defined by the type_uid. string
type_uid Required: The event/finding type ID. It identifies the event's semantics and structure. long
unmapped Optional: The attributes that are not mapped to the event schema. object
user Required: The user that is being discovered by an inventory process. object
user.account Optional: The user's account or the account associated with the user. object
user.account.name Recommended: The name of the account (For example, GCP Account Name). string
user.account.type Optional: The account type, normalized to the caption of 'account_type_id'. string
user.account.type_id Recommended: The normalized account type identifier. integer
user.account.uid Recommended: The unique identifier of the account (For example, AWS Account ID). string
user.domain Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. string
user.email_addr Optional: The user's primary email address. string
user.full_name Optional: The full name of the person, as per the LDAP Common Name attribute (cn). string
user.name Recommended: The username. For example, janedoe1. string
user.org Optional: Organization and org unit related to the user. object
user.org.name Recommended: The name of the organization. For example, Widget, Inc. string
user.org.ou_name Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D string
user.org.uid Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. string
user.risk_level Optional: The risk level, normalized to the caption of the risk_level_id value. string
user.type Optional: The type of the user. For example, System, AWS IAM User. string
user.type_id Recommended: The account type identifier. integer
user.uid Recommended: The unique user identifier. string
users Recommended: The users that belong to the administrative group. array of objects
users.account Optional: The user's account or the account associated with the user. object
users.account.name Recommended: The name of the account (For example, GCP Account Name). string
users.account.type Optional: The account type, normalized to the caption of 'account_type_id'. string
users.account.type_id Recommended: The normalized account type identifier. integer
users.account.uid Recommended: The unique identifier of the account (For example, AWS Account ID). string
users.domain Optional: The domain where the user is defined. For example: the LDAP or Active Directory domain. string
users.email_addr Optional: The user's primary email address. string
users.full_name Optional: The full name of the person, as per the LDAP Common Name attribute (cn). string
users.name Recommended: The username. For example, janedoe1. string
users.org Optional: Organization and org unit related to the user. object
users.org.name Recommended: The name of the organization. For example, Widget, Inc. string
users.org.ou_name Recommended: The name of the organizational unit, within an organization. For example, Finance, IT, R&D string
users.org.uid Recommended: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. string
users.risk_level Optional: The risk level, normalized to the caption of the risk_level_id value. string
users.type Optional: The type of the user. For example, System, AWS IAM User, etc. string
users.type_id Recommended: The account type identifier. integer
users.uid Recommended: The unique user identifier. string
volume Required: The allocated event volume for the event in bytes. long