diff --git a/AGENTS.md b/AGENTS.md index 2ba6597b9c..8866ead489 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -153,6 +153,7 @@ ocsf_emit!(event); - `crate::ocsf_ctx()` returns the process-wide `EventContext`. It is always available (falls back to defaults in tests). - `ocsf_emit!()` is non-blocking and cannot panic. It stores the event in a thread-local and emits via `tracing::info!()`. +- In `openshell-supervisor-network`, emit with `crate::telemetry::egress_emit!` instead, or `crate::telemetry::emit_decision` for the records of one decision, so denied HTTP decisions get a deny span. Clippy rejects `ocsf_emit!` there. - The shorthand layer and JSONL layer extract the event from the thread-local. The shorthand format is derived automatically from the builder fields. - For security findings, **dual-emit**: one domain event (e.g., `SshActivityBuilder`) AND one `DetectionFindingBuilder` for the same incident. - Never log secrets, credentials, or query parameters in OCSF messages. The OCSF JSONL file may be shipped to external systems. diff --git a/Cargo.lock b/Cargo.lock index 3932bee044..94cc7b3df6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5333,11 +5333,13 @@ dependencies = [ "openshell-ocsf", "openshell-ocsf-validate", "openshell-otel", + "openshell-otel-test-support", "openshell-policy", "openshell-policy-schema", "openshell-sandbox-backend", "openshell-supervisor-middleware", "openshell-supervisor-middleware-builtins", + "opentelemetry-proto", "opentelemetry_sdk", "prost-types", "rcgen", diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json new file mode 100644 index 0000000000..873d9a449c --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json @@ -0,0 +1,8273 @@ +{ + "$defs": { + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", + "type": "string" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "action": { + "title": "Action", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "status": { + "title": "Status", + "type": "string" + }, + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json new file mode 100644 index 0000000000..a0a313d187 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json @@ -0,0 +1,8138 @@ +{ + "$defs": { + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", + "type": "string" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "status": { + "title": "Status", + "type": "string" + }, + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json new file mode 100644 index 0000000000..6c8cf83eb1 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json @@ -0,0 +1,8241 @@ +{ + "$defs": { + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", + "type": "string" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "action": { + "title": "Action", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "status": { + "title": "Status", + "type": "string" + }, + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json new file mode 100644 index 0000000000..ee9a0d4e14 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json @@ -0,0 +1,8106 @@ +{ + "$defs": { + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", + "type": "string" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "status": { + "title": "Status", + "type": "string" + }, + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json new file mode 100644 index 0000000000..f982941183 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json @@ -0,0 +1,8265 @@ +{ + "$defs": { + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", + "type": "string" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "action": { + "title": "Action", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "status": { + "title": "Status", + "type": "string" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json new file mode 100644 index 0000000000..7c1523afd3 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json @@ -0,0 +1,8130 @@ +{ + "$defs": { + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", + "type": "string" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "status": { + "title": "Status", + "type": "string" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json new file mode 100644 index 0000000000..1c2e700d12 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json @@ -0,0 +1,8233 @@ +{ + "$defs": { + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", + "type": "string" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "action": { + "title": "Action", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "status": { + "title": "Status", + "type": "string" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json new file mode 100644 index 0000000000..d1315dd7c0 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json @@ -0,0 +1,8098 @@ +{ + "$defs": { + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", + "type": "string" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "status": { + "title": "Status", + "type": "string" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json new file mode 100644 index 0000000000..654712b727 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json @@ -0,0 +1,8326 @@ +{ + "$defs": { + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "endpoint_connection": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "code" + ] + }, + { + "required": [ + "network_endpoint" + ] + } + ], + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "network_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Network Endpoint" + } + }, + "title": "Endpoint Connection", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "network_traffic": { + "additionalProperties": false, + "properties": { + "bytes": { + "title": "Total Bytes", + "type": "integer" + }, + "bytes_in": { + "title": "Bytes In", + "type": "integer" + }, + "bytes_missed": { + "title": "Bytes Missed", + "type": "integer" + }, + "bytes_out": { + "title": "Bytes Out", + "type": "integer" + }, + "chunks": { + "title": "Chunks", + "type": "integer" + }, + "chunks_in": { + "title": "Chunks In", + "type": "integer" + }, + "chunks_out": { + "title": "Chunks Out", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "packets": { + "title": "Total Packets", + "type": "integer" + }, + "packets_in": { + "title": "Packets In", + "type": "integer" + }, + "packets_out": { + "title": "Packets Out", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "timespan": { + "$ref": "#/$defs/timespan", + "title": "Time Span" + } + }, + "title": "Network Traffic", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "packet": { + "additionalProperties": false, + "properties": { + "encoding": { + "title": "Encoding", + "type": "string" + }, + "encoding_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Encoding ID", + "type": "integer" + }, + "end_offset": { + "title": "End Offset", + "type": "integer" + }, + "format": { + "title": "Format", + "type": "string" + }, + "format_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Format ID", + "type": "integer" + }, + "sequence_number": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "source_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Source ID", + "type": "integer" + }, + "start_offset": { + "title": "Start Offset", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Packet", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "network_connection_info": { + "additionalProperties": false, + "properties": { + "boundary": { + "title": "Boundary", + "type": "string" + }, + "boundary_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Boundary ID", + "type": "integer" + }, + "community_uid": { + "title": "Community ID", + "type": "string" + }, + "direction": { + "title": "Direction", + "type": "string" + }, + "direction_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Direction ID", + "type": "integer" + }, + "flag_history": { + "title": "Connection Flag History", + "type": "string" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + }, + "protocol_ver": { + "title": "IP Version", + "type": "string" + }, + "protocol_ver_id": { + "enum": [ + 0, + 4, + 6, + 99 + ], + "title": "IP Version ID", + "type": "integer" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "tcp_flags": { + "title": "TCP Flags", + "type": "integer" + }, + "uid": { + "title": "Connection UID", + "type": "string" + } + }, + "required": [ + "direction_id" + ], + "title": "Network Connection Information", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "load_balancer": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification": { + "title": "Classification", + "type": "string" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "endpoint_connections": { + "items": { + "$ref": "#/$defs/endpoint_connection" + }, + "title": "Endpoint Connections", + "type": "array" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Load Balancer", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "tls": { + "additionalProperties": false, + "properties": { + "alert": { + "title": "Client TLS Alert", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "certificate_chain": { + "items": { + "type": "string" + }, + "title": "Certificate Chain", + "type": "array" + }, + "cipher": { + "title": "Cipher Suite", + "type": "string" + }, + "client_ciphers": { + "items": { + "type": "string" + }, + "title": "Client Cipher Suites", + "type": "array" + }, + "extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "Extension List", + "type": "array" + }, + "handshake_dur": { + "title": "Handshake Duration", + "type": "integer" + }, + "ja3_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3 Hash" + }, + "ja3s_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3S Hash" + }, + "key_length": { + "title": "Key Length", + "type": "integer" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "server_ciphers": { + "items": { + "type": "string" + }, + "title": "Server Cipher Suites", + "type": "array" + }, + "sni": { + "title": "Server Name Indication", + "type": "string" + }, + "tls_extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "TLS Extension List", + "type": "array" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Transport Layer Security (TLS)", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "ja4_fingerprint": { + "additionalProperties": false, + "properties": { + "section_a": { + "title": "JA4 Section A", + "type": "string" + }, + "section_b": { + "title": "JA4 Section B", + "type": "string" + }, + "section_c": { + "title": "JA4 Section C", + "type": "string" + }, + "section_d": { + "title": "JA4 Section D", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "JA4+ Fingerprint", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "http_cookie": { + "additionalProperties": false, + "properties": { + "domain": { + "title": "Domain", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "http_only": { + "title": "HTTP Only", + "type": "boolean" + }, + "is_http_only": { + "title": "HTTP Only", + "type": "boolean" + }, + "is_secure": { + "title": "Secure", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "samesite": { + "title": "SameSite", + "type": "string" + }, + "secure": { + "title": "Secure", + "type": "boolean" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Cookie", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "tls_extension": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 5, + 10, + 13, + 14, + 15, + 16, + 18, + 19, + 20, + 21, + 41, + 42, + 43, + 44, + 45, + 47, + 48, + 49, + 50, + 51, + 99 + ], + "title": "Type ID", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "TLS Extension", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/http_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "http_request" + ] + }, + { + "required": [ + "http_response" + ] + } + ], + "properties": { + "traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Traffic" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", + "type": "string" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "app_name": { + "title": "Application Name", + "type": "string" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "proxy_http_request": { + "$ref": "#/$defs/http_request", + "title": "Proxy HTTP Request" + }, + "app_protocol_name": { + "title": "Application Protocol Name", + "type": "string" + }, + "proxy_connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Proxy Connection Info" + }, + "category_uid": { + "const": 4, + "title": "Category ID", + "type": "integer" + }, + "action": { + "title": "Action", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "ja4_fingerprint_list": { + "items": { + "$ref": "#/$defs/ja4_fingerprint" + }, + "title": "JA4+ Fingerprints", + "type": "array" + }, + "cumulative_traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Cumulative Traffic" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "proxy_tls": { + "$ref": "#/$defs/tls", + "title": "Proxy TLS" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "network_observation_point": { + "$ref": "#/$defs/network_endpoint", + "title": "Network Observation Point" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "proxy_http_response": { + "$ref": "#/$defs/http_response", + "title": "Proxy HTTP Response" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "status": { + "title": "Status", + "type": "string" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "packet_list": { + "items": { + "$ref": "#/$defs/packet" + }, + "title": "Packets", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "proxy_traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Proxy Traffic" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "observation_point_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Observation Point ID", + "type": "integer" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "proxy": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy" + }, + "class_uid": { + "const": 4002, + "title": "Class ID", + "type": "integer" + }, + "http_status": { + "title": "HTTP Status", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "tls": { + "$ref": "#/$defs/tls", + "title": "TLS" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "observation_point": { + "title": "Observation Point", + "type": "string" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "http_cookies": { + "items": { + "$ref": "#/$defs/http_cookie" + }, + "title": "HTTP Cookies", + "type": "array" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Connection Info" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "required": [ + "activity_id", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "time", + "type_uid" + ], + "title": "HTTP Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf/src/events/base_event.rs b/crates/openshell-ocsf/src/events/base_event.rs index e023516de5..4e8554f7a8 100644 --- a/crates/openshell-ocsf/src/events/base_event.rs +++ b/crates/openshell-ocsf/src/events/base_event.rs @@ -13,6 +13,10 @@ use crate::objects::{AiModel, Device, Metadata}; /// Every event class embeds this struct via `#[serde(flatten)]`. #[derive(Debug, Clone, PartialEq, Eq, Deserialize)] pub struct BaseEventData { + /// Trace correlation (Trace profile), written only through `set_trace`. + #[serde(default)] + pub(crate) trace: Option, + /// OCSF class UID (e.g., 4001 for Network Activity). pub class_uid: u32, @@ -76,7 +80,6 @@ impl Serialize for BaseEventData { fn serialize(&self, serializer: S) -> Result { use serde::ser::SerializeMap; - // Count fields: 9 required + severity pair (2) + up to 6 optional let mut map = serializer.serialize_map(None)?; map.serialize_entry("class_uid", &self.class_uid)?; @@ -112,6 +115,11 @@ impl Serialize for BaseEventData { if let Some(ref ai_model) = self.ai_model { map.serialize_entry("ai_model", ai_model)?; } + if let Some(ref trace) = self.trace + && crate::trace::accepts_trace(self.class_uid) + { + map.serialize_entry("trace", trace)?; + } if let Some(ref unmapped) = self.unmapped { map.serialize_entry("unmapped", unmapped)?; } @@ -154,6 +162,7 @@ impl BaseEventData { metadata, device: None, ai_model: None, + trace: None, unmapped: None, } } @@ -188,6 +197,25 @@ impl BaseEventData { self.ai_model = Some(ai_model); } + /// Set trace correlation and add the Trace profile once. + /// + /// OCSF 1.8.0 declares the Trace profile only for HTTP Activity and API + /// Activity, so other classes ignore it. + pub(crate) fn set_trace(&mut self, trace: crate::TraceCorrelation) { + if !crate::trace::accepts_trace(self.class_uid) { + return; + } + self.trace = Some(trace); + if !self + .metadata + .profiles + .iter() + .any(|profile| profile == "trace") + { + self.metadata.profiles.push("trace".to_string()); + } + } + /// Add an unmapped field. pub fn add_unmapped(&mut self, key: &str, value: impl Into) { let map = self diff --git a/crates/openshell-ocsf/src/events/mod.rs b/crates/openshell-ocsf/src/events/mod.rs index e57a870f54..66038cd9cb 100644 --- a/crates/openshell-ocsf/src/events/mod.rs +++ b/crates/openshell-ocsf/src/events/mod.rs @@ -168,6 +168,22 @@ impl OcsfEvent { Self::Base(e) => &e.base, } } + + /// Returns mutable base data common to all event classes. + pub(crate) fn base_mut(&mut self) -> &mut BaseEventData { + match self { + Self::NetworkActivity(e) => &mut e.base, + Self::HttpActivity(e) => &mut e.base, + Self::SshActivity(e) => &mut e.base, + Self::ProcessActivity(e) => &mut e.base, + Self::Authentication(e) => &mut e.base, + Self::DetectionFinding(e) => &mut e.base, + Self::ApplicationLifecycle(e) => &mut e.base, + Self::DeviceConfigStateChange(e) => &mut e.base, + Self::ApiActivity(e) => &mut e.base, + Self::Base(e) => &mut e.base, + } + } } #[cfg(test)] diff --git a/crates/openshell-ocsf/src/lib.rs b/crates/openshell-ocsf/src/lib.rs index 661b4c6f5a..4b169e165c 100644 --- a/crates/openshell-ocsf/src/lib.rs +++ b/crates/openshell-ocsf/src/lib.rs @@ -31,6 +31,9 @@ pub mod events; pub mod format; pub mod objects; pub mod sanitize; +mod trace; + +pub use trace::{TraceCorrelation, register_trace_correlation_extractor}; pub mod tracing_layers; #[cfg(any(test, feature = "test-support"))] diff --git a/crates/openshell-ocsf/src/trace.rs b/crates/openshell-ocsf/src/trace.rs new file mode 100644 index 0000000000..9651e00336 --- /dev/null +++ b/crates/openshell-ocsf/src/trace.rs @@ -0,0 +1,226 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +//! OCSF trace correlation and optional enrichment at emission. + +use std::sync::OnceLock; + +use serde::{Deserialize, Serialize}; + +/// W3C trace ID of the span active when an OCSF event was emitted. +/// +/// This is a correlation hint, not an identity assertion: gateway context may +/// inherit a caller's traceparent, including before authentication. +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +#[serde(try_from = "TraceFields")] +pub struct TraceCorrelation { + uid: String, +} + +#[derive(Deserialize)] +struct TraceFields { + uid: String, +} + +impl TryFrom for TraceCorrelation { + type Error = &'static str; + + fn try_from(fields: TraceFields) -> Result { + let uid = fields.uid; + let hex = uid.len() == 32 && uid.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')); + if !hex || uid.bytes().all(|b| b == b'0') { + return Err("trace.uid must be a non-zero W3C trace ID in lowercase hex"); + } + Ok(Self { uid }) + } +} + +impl TraceCorrelation { + /// Returns `None` for the invalid all-zero trace ID. + #[must_use] + pub fn from_trace_id(trace_id: [u8; 16]) -> Option { + if trace_id == [0; 16] { + return None; + } + Some(Self { + uid: format!("{:032x}", u128::from_be_bytes(trace_id)), + }) + } + + /// The trace ID as 32 lowercase hexadecimal characters. + #[must_use] + pub fn uid(&self) -> &str { + &self.uid + } +} + +static EXTRACTOR: OnceLock Option> = OnceLock::new(); + +/// Register the process-wide trace extractor at startup. +/// +/// Returns `false` if an extractor is already registered. Without an extractor, +/// events carry no trace correlation. +pub fn register_trace_correlation_extractor(extractor: fn() -> Option) -> bool { + EXTRACTOR.set(extractor).is_ok() +} + +/// HTTP Activity and API Activity: the classes OCSF 1.8.0 declares the Trace +/// profile for. +pub const fn accepts_trace(class_uid: u32) -> bool { + matches!(class_uid, 4002 | 6003) +} + +pub fn enrich(event: &mut crate::OcsfEvent) { + if accepts_trace(event.class_uid()) + && event.base().trace.is_none() + && let Some(trace) = EXTRACTOR.get().and_then(|extract| extract()) + { + event.base_mut().set_trace(trace); + } +} + +#[cfg(test)] +mod tests { + use crate::*; + use openshell_ocsf_validate::validate_event; + + const TRACE_ID: [u8; 16] = [ + 0x0a, 0xf7, 0x65, 0x19, 0x16, 0xcd, 0x43, 0xdd, 0x84, 0x48, 0xeb, 0x21, 0x1c, 0x80, 0x31, + 0x9c, + ]; + + fn trace() -> TraceCorrelation { + TraceCorrelation::from_trace_id(TRACE_ID).unwrap() + } + + #[test] + fn trace_id_renders_as_lowercase_w3c_hex() { + assert_eq!(trace().uid(), "0af7651916cd43dd8448eb211c80319c"); + assert!(TraceCorrelation::from_trace_id([0; 16]).is_none()); + } + + #[test] + fn deserialization_rejects_malformed_trace_ids() { + let valid = serde_json::json!({"uid": "0af7651916cd43dd8448eb211c80319c"}); + assert_eq!( + serde_json::from_value::(valid).unwrap(), + trace() + ); + for uid in [ + "", + "0AF7651916CD43DD8448EB211C80319C", + "0af7651916cd43dd8448eb211c80319", + "0af7651916cd43dd8448eb211c80319cz", + "00000000000000000000000000000000", + ] { + assert!( + serde_json::from_value::(serde_json::json!({ "uid": uid })) + .is_err(), + "{uid:?} accepted" + ); + } + } + + #[test] + fn production_event_shapes_validate_with_and_without_trace() { + let ctx = builders::test_sandbox_context(); + for (class, mut event) in builders::sample_events(&ctx) { + let plain = event.to_json().unwrap(); + validate_event(&plain).unwrap_or_else(|e| panic!("{class} without trace: {e}")); + event.base_mut().set_trace(trace()); + let correlated = event.to_json().unwrap(); + validate_event(&correlated).unwrap_or_else(|e| panic!("{class} with trace: {e}")); + if matches!(class, "http_activity" | "api_activity") { + assert_eq!(correlated["trace"]["uid"], trace().uid(), "{class}"); + } else { + assert_eq!(correlated, plain, "{class}"); + } + let decoded: OcsfEvent = serde_json::from_value(correlated.clone()).unwrap(); + assert_eq!(decoded.to_json().unwrap(), correlated); + } + } + + #[test] + fn deserialized_trace_is_dropped_from_classes_without_the_profile() { + let ctx = builders::test_sandbox_context(); + let (_, event) = builders::sample_events(&ctx) + .into_iter() + .find(|(class, _)| *class == "network_activity") + .unwrap(); + let mut value = event.to_json().unwrap(); + value["trace"] = serde_json::json!({"uid": trace().uid()}); + let decoded: OcsfEvent = serde_json::from_value(value).unwrap(); + assert!(decoded.to_json().unwrap().get("trace").is_none()); + } + + #[test] + fn gateway_api_activity_shapes_validate_with_trace() { + let ctx = builders::test_gateway_context(); + let events = [ + ApiActivityBuilder::new(&ctx, "CreateSandbox").build(), + ApiActivityBuilder::new(&ctx, "CreateSandbox") + .action(ActionId::Denied) + .build(), + ApiActivityBuilder::new(&ctx, "chat.completions") + .ai_model(AiModel::new("model", "provider")) + .build(), + ]; + for mut event in events { + event.base_mut().set_trace(trace()); + let correlated = event.to_json().unwrap(); + validate_event(&correlated).unwrap_or_else(|e| panic!("{correlated}: {e}")); + assert_eq!(correlated["trace"]["uid"], trace().uid()); + } + } + + #[test] + fn exported_schema_checks_trace_shape_and_declared_profile() { + let ctx = builders::test_sandbox_context(); + let (_, mut event) = builders::sample_events(&ctx) + .into_iter() + .find(|(class, _)| *class == "http_activity") + .unwrap(); + event.base_mut().set_trace(trace()); + let mut value = event.to_json().unwrap(); + validate_event(&value).unwrap_or_else(|e| panic!("{e}")); + value["trace"]["uid"] = serde_json::json!(42); + assert!(matches!( + validate_event(&value), + Err(openshell_ocsf_validate::Error::Invalid(_)) + )); + value["trace"] = serde_json::json!({}); + assert!(matches!( + validate_event(&value), + Err(openshell_ocsf_validate::Error::Invalid(_)) + )); + value["trace"] = + serde_json::json!({"uid": "0af7651916cd43dd8448eb211c80319c", "bogus": true}); + assert!(matches!( + validate_event(&value), + Err(openshell_ocsf_validate::Error::Invalid(_)) + )); + value["trace"].as_object_mut().unwrap().remove("bogus"); + value["metadata"]["profiles"] + .as_array_mut() + .unwrap() + .retain(|name| name != "trace"); + assert!(matches!( + validate_event(&value), + Err(openshell_ocsf_validate::Error::Invalid(_)) + )); + } + + #[test] + fn plain_event_omits_trace_profile_and_object() { + let ctx = builders::test_sandbox_context(); + let value = BaseEventBuilder::new(&ctx).build().to_json().unwrap(); + assert!(value.get("trace").is_none()); + assert!( + !value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|p| p == "trace") + ); + } +} diff --git a/crates/openshell-ocsf/src/tracing_layers/event_bridge.rs b/crates/openshell-ocsf/src/tracing_layers/event_bridge.rs index c4a5ccb895..ca5a5e9cdd 100644 --- a/crates/openshell-ocsf/src/tracing_layers/event_bridge.rs +++ b/crates/openshell-ocsf/src/tracing_layers/event_bridge.rs @@ -34,7 +34,8 @@ pub fn clone_current_event() -> Option { /// as human-readable shorthand and structured JSONL for their configured sinks. /// /// Both layers receive the event — `clone_current_event()` is non-consuming. -pub fn emit_ocsf_event(event: OcsfEvent) { +pub fn emit_ocsf_event(mut event: OcsfEvent) { + crate::trace::enrich(&mut event); // Store the event in thread-local so layers can access it set_current_event(event); @@ -81,7 +82,8 @@ pub fn clear_current_event() { /// bare `emit_ocsf_event`, but the gateway hosts many sandboxes, so it stamps a /// per-event `sandbox_id` field here instead. One tracing event feeds both the /// JSONL audit file and the routing bus. -pub fn emit_ocsf_event_routed(sandbox_id: &str, event: OcsfEvent) { +pub fn emit_ocsf_event_routed(sandbox_id: &str, mut event: OcsfEvent) { + crate::trace::enrich(&mut event); let message = event.format_shorthand(); set_current_event(event); tracing::info!(target: "ocsf", sandbox_id = %sandbox_id, message = %message); diff --git a/crates/openshell-otel/src/correlation.rs b/crates/openshell-otel/src/correlation.rs new file mode 100644 index 0000000000..d451ef725b --- /dev/null +++ b/crates/openshell-otel/src/correlation.rs @@ -0,0 +1,27 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +//! Sampled trace correlation for OCSF producers. + +use opentelemetry::trace::{SpanContext, TraceContextExt as _}; + +/// Extract the active span's W3C trace ID for an OCSF event. +/// +/// Returns `None` unless the current span has valid, sampled context. This reads +/// the current span without extracting workload HTTP headers or environment +/// variables. The active span may already inherit a gateway caller's context, +/// including before authentication. This is a correlation hint, not proof of +/// origin. A sampled ID does not guarantee export or retention. +#[must_use] +pub fn current_ocsf_trace_correlation() -> Option { + let span_context = sampled_span_context()?; + openshell_ocsf::TraceCorrelation::from_trace_id(span_context.trace_id().to_bytes()) +} + +/// The OpenTelemetry tracing layer activates a span's context on entry, so this +/// also works inside a layer, where the tracing dispatcher is busy. +pub fn sampled_span_context() -> Option { + let context = opentelemetry::Context::current(); + let span_context = context.span().span_context().clone(); + (span_context.is_valid() && span_context.is_sampled()).then_some(span_context) +} diff --git a/crates/openshell-otel/src/lib.rs b/crates/openshell-otel/src/lib.rs index 78b995ee0d..1f9de6bf17 100644 --- a/crates/openshell-otel/src/lib.rs +++ b/crates/openshell-otel/src/lib.rs @@ -3,6 +3,9 @@ //! Shared OpenTelemetry trace and log export support for `OpenShell` services. +mod correlation; +pub use correlation::current_ocsf_trace_correlation; + mod driver; mod grpc; mod headers; @@ -54,6 +57,18 @@ use tracing_subscriber::Layer as _; use tracing_subscriber::layer::{Context, Filter}; use tracing_subscriber::registry::LookupSpan; +/// Export supervisor spans at INFO by default, or DEBUG and TRACE when enabled. +/// Dependency spans remain at INFO. +#[must_use] +pub fn supervisor_span_filter(log_level: &str) -> tracing_subscriber::EnvFilter { + use tracing_subscriber::filter::LevelFilter; + let level = log_level + .parse::() + .unwrap_or(LevelFilter::INFO) + .max(LevelFilter::INFO); + tracing_subscriber::EnvFilter::new(format!("info,openshell={level}")) +} + const SDK_UNKNOWN_SERVICE_PREFIX: &str = "unknown_service"; /// Build the resource attributes shared by gateway and compute-driver providers. @@ -566,6 +581,15 @@ pub(crate) fn test_lock() -> std::sync::MutexGuard<'static, ()> { mod tests { use super::*; + #[test] + fn supervisor_span_filter_raises_only_openshell_targets() { + let directives = |log_level: &str| supervisor_span_filter(log_level).to_string(); + assert_eq!(directives("warn"), "openshell=info,info"); + assert_eq!(directives("info"), "openshell=info,info"); + assert_eq!(directives("debug"), "openshell=debug,info"); + assert_eq!(directives("info,h2=debug"), "openshell=info,info"); + } + #[test] fn error_status_guard_marks_only_unfinished_results() { use tracing_subscriber::layer::SubscriberExt as _; diff --git a/crates/openshell-otel/src/ocsf.rs b/crates/openshell-otel/src/ocsf.rs index 3ad4dd7173..63489fde1d 100644 --- a/crates/openshell-otel/src/ocsf.rs +++ b/crates/openshell-otel/src/ocsf.rs @@ -116,10 +116,11 @@ impl Layer for OcsfOtlpLayer { let Some(event) = clone_current_event() else { return; }; - let Ok(record) = log_record(&self.logger, &event, SystemTime::now()) else { + let Ok(mut record) = log_record(&self.logger, &event, SystemTime::now()) else { self.gap.record_loss("serialization", 1); return; }; + set_trace_context(&mut record); let bytes = record_bytes(&record); if bytes > BATCH_MAX_BYTES { self.gap.record_loss("oversized", 1); @@ -399,6 +400,18 @@ fn log_record( Ok(record) } +/// Link the record to the active sampled span through the OTLP record's own +/// trace fields, for every OCSF class. +fn set_trace_context(record: &mut SdkLogRecord) { + if let Some(span_context) = crate::correlation::sampled_span_context() { + record.set_trace_context( + span_context.trace_id(), + span_context.span_id(), + Some(span_context.trace_flags()), + ); + } +} + /// Map an OCSF severity onto an OTLP severity. /// /// OCSF ranks more levels than OTLP has bands. Low and Medium share the WARN @@ -418,7 +431,10 @@ fn severity(severity: SeverityId) -> Severity { #[cfg(test)] mod tests { use super::*; - use openshell_ocsf::{ConfigStateChangeBuilder, EventContext, EventOrigin, ocsf_emit}; + use openshell_ocsf::{ + ConfigStateChangeBuilder, EventContext, EventOrigin, HttpActivityBuilder, HttpRequest, Url, + ocsf_emit, + }; use opentelemetry::Key; use opentelemetry::logs::{AnyValue, Severity}; use opentelemetry_sdk::Resource; @@ -479,6 +495,41 @@ mod tests { assert_eq!(body(&record(&event)), native(&event)); } + #[test] + fn trace_body_preserves_native_correlation() { + let mut correlated = native( + &HttpActivityBuilder::new(&event_context("sandbox-1")) + .http_request(HttpRequest::new( + "GET", + Url::new("https", "example.com", "/", 443), + )) + .build(), + ); + correlated["trace"] = serde_json::json!({"uid": "0af7651916cd43dd8448eb211c80319c"}); + correlated["metadata"]["profiles"] + .as_array_mut() + .unwrap() + .push("trace".into()); + let event: OcsfEvent = serde_json::from_value(correlated).unwrap(); + let native_body = body(&record(&event)); + assert_eq!(native_body, native(&event)); + assert_eq!( + native_body["trace"]["uid"], + "0af7651916cd43dd8448eb211c80319c" + ); + assert!( + native_body["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|profile| profile == "trace") + ); + assert_eq!( + native_body["metadata"]["version"], + openshell_ocsf::OCSF_VERSION + ); + } + #[test] fn timestamps_are_event_time_and_observed_time() { let event = event("sandbox-1", SeverityId::Informational); @@ -719,6 +770,42 @@ mod tests { assert_eq!(exporter.service_name().as_deref(), Some("openshell-test")); } + #[tokio::test] + async fn records_carry_the_sampled_span_context_for_every_class() { + use opentelemetry::trace::TraceContextExt as _; + use opentelemetry_sdk::trace::{InMemorySpanExporter, Sampler, SdkTracerProvider}; + use tracing_opentelemetry::OpenTelemetrySpanExt as _; + + for sampler in [Sampler::AlwaysOn, Sampler::AlwaysOff] { + let exporter = RecordingExporter::default(); + let otlp = OcsfOtlp::start(exporter.clone(), exporter_resource()); + let tracer = SdkTracerProvider::builder() + .with_sampler(sampler) + .with_simple_exporter(InMemorySpanExporter::default()) + .build(); + let subscriber = tracing_subscriber::registry() + .with(crate::layer(&tracer, "ocsf-test")) + .with(otlp.layer()); + let span_context = tracing::subscriber::with_default(subscriber, || { + let span = tracing::info_span!("decision"); + span.in_scope(|| ocsf_emit!(event("sandbox-1", SeverityId::Medium))); + span.context().span().span_context().clone() + }); + otlp.shutdown().await; + + let records = exporter.exported(); + let trace = records[0].record.trace_context(); + if span_context.is_sampled() { + let trace = trace.expect("sampled span context is attached"); + assert_eq!(trace.trace_id, span_context.trace_id()); + assert_eq!(trace.span_id, span_context.span_id()); + assert_eq!(trace.trace_flags, Some(span_context.trace_flags())); + } else { + assert!(trace.is_none()); + } + } + } + #[tokio::test] async fn shutdown_exports_every_queued_record_in_bounded_batches() { let exporter = RecordingExporter::default(); diff --git a/crates/openshell-otel/tests/ocsf_correlation.rs b/crates/openshell-otel/tests/ocsf_correlation.rs new file mode 100644 index 0000000000..acf3f1a334 --- /dev/null +++ b/crates/openshell-otel/tests/ocsf_correlation.rs @@ -0,0 +1,228 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +use std::sync::{Arc, LazyLock, Mutex}; + +use openshell_ocsf::{ + ApiActivityBuilder, AuthenticationBuilder, Endpoint, HttpActivityBuilder, HttpRequest, + NetworkActivityBuilder, OcsfEvent, OcsfJsonlLayer, Service, Url, User, ocsf_emit, +}; +use opentelemetry_sdk::trace::{InMemorySpanExporterBuilder, Sampler, SdkTracerProvider}; +use tracing_subscriber::prelude::*; + +static SETUP: LazyLock<()> = LazyLock::new(|| { + tracing::subscriber::set_global_default(tracing_subscriber::registry()).unwrap(); + assert!(openshell_ocsf::register_trace_correlation_extractor( + openshell_otel::current_ocsf_trace_correlation, + )); +}); + +#[derive(Clone)] +struct Writer(Arc>>); +impl std::io::Write for Writer { + fn write(&mut self, bytes: &[u8]) -> std::io::Result { + self.0.lock().unwrap().extend_from_slice(bytes); + Ok(bytes.len()) + } + fn flush(&mut self) -> std::io::Result<()> { + Ok(()) + } +} + +fn capture( + sampler: Sampler, + active: bool, +) -> (serde_json::Value, Vec) { + capture_route(sampler, active, false) +} + +fn http_event() -> OcsfEvent { + HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .http_request(HttpRequest::new( + "GET", + Url::new("https", "example.com", "/", 443), + )) + .build() +} + +fn capture_event(build: fn() -> OcsfEvent) -> serde_json::Value { + capture_context(Sampler::AlwaysOn, true, false, None, build).0 +} + +fn capture_route( + sampler: Sampler, + active: bool, + routed: bool, +) -> (serde_json::Value, Vec) { + capture_context(sampler, active, routed, None, http_event) +} + +fn capture_context( + sampler: Sampler, + active: bool, + routed: bool, + remote_parent: Option, + build: fn() -> OcsfEvent, +) -> (serde_json::Value, Vec) { + LazyLock::force(&SETUP); + let exporter = InMemorySpanExporterBuilder::new().build(); + let provider = SdkTracerProvider::builder() + .with_sampler(sampler) + .with_simple_exporter(exporter.clone()) + .build(); + let bytes = Arc::new(Mutex::new(vec![])); + let subscriber = tracing_subscriber::registry() + .with(openshell_otel::layer(&provider, "ocsf-test")) + .with(OcsfJsonlLayer::new(Writer(bytes.clone()))); + tracing::subscriber::with_default(subscriber, || { + let emit = || { + if routed { + openshell_ocsf::emit_ocsf_event_routed("test-sandbox", build()); + } else { + ocsf_emit!(build()); + } + }; + if active { + let span = tracing::info_span!("sampled-operation"); + if let Some(parent) = remote_parent { + use opentelemetry::trace::TraceContextExt as _; + use tracing_opentelemetry::OpenTelemetrySpanExt as _; + span.set_parent(opentelemetry::Context::new().with_remote_span_context(parent)) + .unwrap(); + } + span.in_scope(emit); + } else { + emit(); + } + }); + let value = serde_json::from_slice(&bytes.lock().unwrap()).unwrap(); + provider.force_flush().unwrap(); + let spans = exporter.get_finished_spans().unwrap(); + provider.shutdown().unwrap(); + (value, spans) +} + +#[test] +fn api_activity_correlation_can_inherit_sampled_or_unsampled_caller_context() { + use opentelemetry::trace::{SpanContext, SpanId, TraceFlags, TraceId, TraceState}; + let uid = "0af7651916cd43dd8448eb211c80319c"; + for sampled in [true, false] { + let parent = SpanContext::new( + TraceId::from_hex(uid).unwrap(), + SpanId::from_hex("b7ad6b7169203331").unwrap(), + if sampled { + TraceFlags::SAMPLED + } else { + TraceFlags::default() + }, + true, + TraceState::default(), + ); + let (event, spans) = capture_context( + Sampler::ParentBased(Box::new(Sampler::AlwaysOn)), + true, + false, + Some(parent), + || ApiActivityBuilder::new(openshell_ocsf::ctx::ctx(), "CreateSandbox").build(), + ); + assert_eq!(event["class_uid"], 6003); + if sampled { + assert_eq!(event["trace"]["uid"], uid); + assert_eq!(spans.len(), 1); + assert_eq!(spans[0].span_context.trace_id().to_string(), uid); + } else { + assert_no_trace(&event); + assert!(spans.is_empty()); + } + } +} + +fn assert_no_trace(value: &serde_json::Value) { + assert!(value.get("trace").is_none()); + assert!( + !value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|p| p == "trace") + ); +} + +#[test] +fn classes_without_the_trace_profile_stay_uncorrelated() { + assert_no_trace(&capture_event(|| { + NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .dst_endpoint(Endpoint::from_domain("example.com", 443)) + .build() + })); + assert_no_trace(&capture_event(|| { + AuthenticationBuilder::new( + openshell_ocsf::ctx::ctx(), + User::unidentified(), + Service::new("openshell-gateway"), + ) + .build() + })); +} + +#[test] +fn sampled_active_span_correlates_to_exported_w3c_trace() { + let (value, spans) = capture(Sampler::AlwaysOn, true); + let uid = value["trace"]["uid"].as_str().unwrap(); + assert_eq!(uid.len(), 32); + assert!( + uid.bytes() + .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b)) + ); + assert_eq!(uid, spans[0].span_context.trace_id().to_string()); + assert_eq!( + value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .filter(|p| *p == "trace") + .count(), + 1 + ); + assert_eq!(value["trace"].as_object().unwrap().len(), 1); +} + +#[test] +fn no_active_context_omits_trace_and_profile() { + let (value, spans) = capture(Sampler::AlwaysOn, false); + assert_no_trace(&value); + assert!(spans.is_empty()); +} + +#[test] +fn routed_emission_also_enriches_from_sampled_context() { + let (value, spans) = capture_route(Sampler::AlwaysOn, true, true); + assert_eq!( + value["trace"]["uid"], + spans[0].span_context.trace_id().to_string() + ); + assert!( + value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|p| p == "trace") + ); +} + +#[test] +fn unsampled_active_context_omits_trace_and_profile() { + let (value, spans) = capture(Sampler::AlwaysOff, true); + assert_no_trace(&value); + assert!(spans.is_empty()); +} + +#[test] +fn active_tracing_span_without_otel_context_is_invalid() { + LazyLock::force(&SETUP); + tracing::subscriber::with_default(tracing_subscriber::registry(), || { + tracing::info_span!("no-otel-layer").in_scope(|| { + assert!(openshell_otel::current_ocsf_trace_correlation().is_none()); + }); + }); +} diff --git a/crates/openshell-server/src/cli.rs b/crates/openshell-server/src/cli.rs index 1f0f215881..55ad3091ea 100644 --- a/crates/openshell-server/src/cli.rs +++ b/crates/openshell-server/src/cli.rs @@ -799,6 +799,10 @@ async fn run_from_args( let prepared = prepare_server_config_with_drivers(&mut args, &matches, &compute_drivers)?; validate_user_auth(&prepared.config)?; + openshell_ocsf::register_trace_correlation_extractor( + openshell_otel::current_ocsf_trace_correlation, + ); + // Initialize OCSF identity before tracing can emit gateway events. let gateway_identity = crate::gateway_ocsf::GatewayIdentity { name: prepared.config.name.clone(), diff --git a/crates/openshell-supervisor-network/Cargo.toml b/crates/openshell-supervisor-network/Cargo.toml index aa3ca35014..7043f30d24 100644 --- a/crates/openshell-supervisor-network/Cargo.toml +++ b/crates/openshell-supervisor-network/Cargo.toml @@ -67,10 +67,12 @@ bundled-ca-roots = ["dep:webpki-roots"] openshell-sandbox-backend = { path = "../openshell-sandbox-backend", features = ["test-support"] } openshell-driver-vm = { path = "../openshell-driver-vm", default-features = false, features = ["allocation-tracking"] } +openshell-otel-test-support = { path = "../openshell-otel-test-support" } openshell-ocsf = { path = "../openshell-ocsf", features = ["test-support"] } openshell-ocsf-validate = { path = "../openshell-ocsf-validate" } openshell-otel = { path = "../openshell-otel" } openshell-supervisor-middleware-builtins = { path = "../openshell-supervisor-middleware-builtins" } +opentelemetry-proto = { workspace = true } opentelemetry_sdk = { workspace = true, features = ["testing"] } temp-env = "0.3" tokio = { workspace = true, features = ["test-util"] } diff --git a/crates/openshell-supervisor-network/clippy.toml b/crates/openshell-supervisor-network/clippy.toml new file mode 100644 index 0000000000..0b7005afb4 --- /dev/null +++ b/crates/openshell-supervisor-network/clippy.toml @@ -0,0 +1,6 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +disallowed-macros = [ + { path = "openshell_ocsf::ocsf_emit", reason = "use crate::telemetry::egress_emit so denied HTTP decisions get a deny span" }, +] diff --git a/crates/openshell-supervisor-network/src/google_cloud_metadata.rs b/crates/openshell-supervisor-network/src/google_cloud_metadata.rs index aec80473a3..ea5d0c16bd 100644 --- a/crates/openshell-supervisor-network/src/google_cloud_metadata.rs +++ b/crates/openshell-supervisor-network/src/google_cloud_metadata.rs @@ -16,8 +16,10 @@ use http::StatusCode; use miette::{IntoDiagnostic, Result}; use openshell_core::provider_credentials::ProviderCredentialState; use openshell_ocsf::{ - ActivityId, HttpActivityBuilder, HttpRequest, SeverityId, StatusId, ocsf_emit, + ActionId, ActivityId, DispositionId, HttpActivityBuilder, HttpRequest, SeverityId, StatusId, }; + +use crate::telemetry::egress_emit; use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt}; type MetadataResponse = (u16, &'static str, String); @@ -311,7 +313,7 @@ fn emit_metadata_event( status: StatusId, message: &str, ) { - ocsf_emit!(build_metadata_event( + egress_emit!(build_metadata_event( method, response_code, severity, @@ -327,7 +329,7 @@ fn build_metadata_event( status: StatusId, message: &str, ) -> openshell_ocsf::OcsfEvent { - HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + let mut builder = HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::for_http_method(method)) .http_request(HttpRequest { http_method: method.parse().expect("HTTP method parsing is infallible"), @@ -338,8 +340,13 @@ fn build_metadata_event( }) .severity(severity) .status(status) - .message(message.to_string()) - .build() + .message(message.to_string()); + if matches!(response_code, 403 | 405) { + builder = builder + .action(ActionId::Denied) + .disposition(DispositionId::Blocked); + } + builder.build() } #[cfg(test)] @@ -347,6 +354,26 @@ mod tests { use super::*; use std::collections::HashMap; + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn metadata_rejections_have_deny_traces_but_operational_failures_do_not() { + use crate::telemetry::tests::{assert_deny_resolves, exported}; + + let (events, received) = exported("warn", || { + let ctx = make_context(HashMap::new()); + route_request(&ctx, "GET", PATH_TOKEN, &[]); + route_request(&ctx, "POST", PATH_TOKEN, &flavor_headers()); + route_request(&ctx, "GET", "/unknown", &flavor_headers()); + route_request(&ctx, "GET", PATH_TOKEN, &flavor_headers()); + }) + .await; + assert_eq!(events.len(), 4); + assert_deny_resolves(&events[..2], &received, true); + for event in &events[2..] { + assert!(event.get("trace").is_none()); + } + assert_eq!(received.spans.len(), 2); + } + fn token_binding() -> openshell_core::proto::StaticCredentialBinding { openshell_core::proto::StaticCredentialBinding { endpoints: vec![openshell_core::proto::StaticCredentialEndpointBinding { diff --git a/crates/openshell-supervisor-network/src/host.rs b/crates/openshell-supervisor-network/src/host.rs index b5ada8b100..d6fbe2e54f 100644 --- a/crates/openshell-supervisor-network/src/host.rs +++ b/crates/openshell-supervisor-network/src/host.rs @@ -23,7 +23,7 @@ use openshell_core::proto::SandboxPolicy as ProtoSandboxPolicy; use openshell_core::provider_credentials::ProviderCredentialState; use openshell_isolation_interface::contract::{BinaryIdentity, ExecutableIdentity, Sha256Digest}; use openshell_ocsf::{ - ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ctx::ctx as ocsf_ctx, ocsf_emit, + ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ctx::ctx as ocsf_ctx, }; use tokio::sync::mpsc::UnboundedSender; @@ -125,7 +125,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { let cert_cache = CertCache::new(ca); let state = Arc::new(ProxyTlsState::new(cert_cache, upstream_config)); - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -138,7 +138,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) @@ -152,7 +152,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) @@ -167,7 +167,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) @@ -181,7 +181,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) diff --git a/crates/openshell-supervisor-network/src/l7/middleware.rs b/crates/openshell-supervisor-network/src/l7/middleware.rs index de2aa20613..73c317be6f 100644 --- a/crates/openshell-supervisor-network/src/l7/middleware.rs +++ b/crates/openshell-supervisor-network/src/l7/middleware.rs @@ -5,10 +5,11 @@ use crate::l7::relay::L7EvalContext; use crate::opa::PolicyGenerationGuard; +use crate::telemetry::egress_emit; use miette::{Result, miette}; use openshell_ocsf::{ ActionId, ActivityId, DetectionFindingBuilder, DispositionId, Endpoint, FindingInfo, - HttpActivityBuilder, HttpRequest, NetworkActivityBuilder, SeverityId, StatusId, ocsf_emit, + HttpActivityBuilder, HttpRequest, NetworkActivityBuilder, SeverityId, StatusId, }; use std::path::PathBuf; use tokio::io::{AsyncRead, AsyncWrite}; @@ -146,7 +147,7 @@ pub fn uninspectable_traffic_gate( /// Emit the detection finding for traffic a matching middleware chain cannot /// inspect: denied under a fail-closed chain, bypassed under fail-open. pub fn emit_middleware_uninspectable(ctx: &L7EvalContext, detail: &str, denied: bool) { - let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + let mut event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(if denied { SeverityId::High } else { @@ -166,9 +167,11 @@ pub fn emit_middleware_uninspectable(ctx: &L7EvalContext, detail: &str, denied: "Uninspectable traffic to host with required middleware; denied" } else { "Uninspectable traffic bypassed middleware (fail_open)" - }) - .build(); - ocsf_emit!(event); + }); + if denied { + event = event.action(ActionId::Denied); + } + egress_emit!(event.build()); } pub fn emit_websocket_preflight_events( @@ -178,13 +181,13 @@ pub fn emit_websocket_preflight_events( emit_websocket_invocations(ctx, &outcome.invocations); emit_websocket_coverage(ctx, &outcome.coverage); for event in websocket_preflight_finding_events(outcome) { - ocsf_emit!(event); + egress_emit!(event); } if outcome.saturated { emit_websocket_saturation(ctx); } if outcome.session_capacity_exhausted { - emit_middleware_session_capacity_exhausted(ctx); + emit_middleware_session_capacity_exhausted(ctx, !outcome.allowed); } } @@ -193,7 +196,7 @@ pub(super) fn emit_websocket_coverage( coverage: &[openshell_supervisor_middleware::WebSocketCoverage], ) { for event in websocket_coverage_events(ctx, coverage) { - ocsf_emit!(event); + egress_emit!(event); } } @@ -263,7 +266,7 @@ pub(super) fn emit_websocket_message_events( emit_websocket_saturation(ctx); } for event in websocket_message_finding_events(outcome) { - ocsf_emit!(event); + egress_emit!(event); } } @@ -385,10 +388,15 @@ fn emit_websocket_invocations( invocation.transformed, )) .build(); - ocsf_emit!(event); + egress_emit!(event); if invocation.failed { - let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) - .severity(if invocation.outcome == Outcome::FailClosed { + let fail_closed = invocation.outcome == Outcome::FailClosed; + let mut finding = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()); + if fail_closed { + finding = finding.action(ActionId::Denied); + } + let event = finding + .severity(if fail_closed { SeverityId::High } else { SeverityId::Medium @@ -406,7 +414,7 @@ fn emit_websocket_invocations( ]) .message("WebSocket middleware stage failed") .build(); - ocsf_emit!(event); + egress_emit!(event); } if invocation.stage_disabled { let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) @@ -426,7 +434,7 @@ fn emit_websocket_invocations( "WebSocket middleware stage stream became unusable and was disabled for this session", ) .build(); - ocsf_emit!(event); + egress_emit!(event); } } } @@ -445,11 +453,11 @@ fn emit_websocket_saturation(ctx: &L7EvalContext) { ]) .message("WebSocket middleware work waited for admission capacity") .build(); - ocsf_emit!(event); + egress_emit!(event); } -fn emit_middleware_session_capacity_exhausted(ctx: &L7EvalContext) { - let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) +fn emit_middleware_session_capacity_exhausted(ctx: &L7EvalContext, denied: bool) { + let mut event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Medium) .finding_info(FindingInfo::new( "openshell.middleware.session_capacity_exhausted", @@ -460,13 +468,16 @@ fn emit_middleware_session_capacity_exhausted(ctx: &L7EvalContext) { ("host", ctx.host.as_str()), ("operation", "websocket_message"), ]) - .message("Persistent middleware session admission was refused at process capacity") - .build(); - ocsf_emit!(event); + .message("Persistent middleware session admission was refused at process capacity"); + if denied { + event = event.action(ActionId::Denied); + } + egress_emit!(event.build()); } fn middleware_admission_exhausted_event(ctx: &L7EvalContext) -> openshell_ocsf::OcsfEvent { DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .action(ActionId::Denied) .severity(SeverityId::Medium) .finding_info(FindingInfo::new( "openshell.middleware.admission_exhausted", @@ -483,7 +494,7 @@ fn middleware_admission_exhausted_event(ctx: &L7EvalContext) -> openshell_ocsf:: } fn emit_middleware_admission_exhausted(ctx: &L7EvalContext) { - ocsf_emit!(middleware_admission_exhausted_event(ctx)); + egress_emit!(middleware_admission_exhausted_event(ctx)); } /// Largest body-buffering limit across the entries that actually resolved to a @@ -790,7 +801,7 @@ pub(super) fn resolve_unbuffered_body( } fn emit_middleware_body_unavailable(ctx: &L7EvalContext, denied: bool) { - let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + let mut event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(if denied { SeverityId::High } else { @@ -809,9 +820,11 @@ fn emit_middleware_body_unavailable(ctx: &L7EvalContext, denied: bool) { "Request body exceeded middleware inspection cap; denied" } else { "Request body exceeded middleware inspection cap; passed through (fail_open)" - }) - .build(); - ocsf_emit!(event); + }); + if denied { + event = event.action(ActionId::Denied); + } + egress_emit!(event.build()); } /// Parse the raw header block into middleware-visible headers, preserving @@ -962,6 +975,7 @@ pub(super) fn middleware_events( "openshell.middleware.failure", "Supervisor middleware failure", )) + .action(ActionId::Denied) .message("Required supervisor middleware failed closed") .build(); events.push(event); @@ -981,6 +995,7 @@ pub(super) fn middleware_events( ("policy", ctx.policy_name.as_str()), ("host", ctx.host.as_str()), ]) + .action(ActionId::Denied) .message("Transformed request denied because policy evaluation failed") .build(); events.push(event); @@ -999,8 +1014,208 @@ fn emit_middleware_events( req: &crate::l7::provider::L7Request, outcome: &openshell_supervisor_middleware::ChainOutcome, ) { - for event in middleware_events(ctx, req, outcome) { - ocsf_emit!(event); + crate::telemetry::emit_decision(middleware_events(ctx, req, outcome), None); +} + +#[cfg(test)] +mod trace_tests { + use super::*; + use crate::telemetry::tests::{assert_deny_resolves, assert_no_deny, deny_spans, exported}; + use openshell_supervisor_middleware::{ChainOutcome, MiddlewareInvocation, NamespacedFinding}; + + fn finding() -> NamespacedFinding { + NamespacedFinding { + middleware: "guard".to_string(), + finding: openshell_core::proto::Finding { + r#type: "test.finding".to_string(), + label: "Test finding".to_string(), + count: 1, + severity: "high".to_string(), + ..Default::default() + }, + } + } + + fn outcome( + allowed: bool, + reason: &str, + applied: Vec, + findings: Vec, + ) -> ChainOutcome { + ChainOutcome { + allowed, + reason: reason.to_string(), + body: vec![], + header_mutations: vec![], + findings, + metadata: std::collections::BTreeMap::new(), + applied, + denial: None, + } + } + + fn request() -> crate::l7::provider::L7Request { + crate::l7::provider::L7Request { + action: "POST".to_string(), + target: "/".to_string(), + query_params: std::collections::HashMap::new(), + raw_header: vec![], + body_length: crate::l7::provider::BodyLength::None, + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn websocket_fail_closed_findings_record_the_denial() { + use openshell_supervisor_middleware::{ + WebSocketInvocation, WebSocketInvocationOutcome as Outcome, + }; + for (outcome, action_id) in [(Outcome::FailClosed, Some(2)), (Outcome::FailOpen, None)] { + let (events, _) = exported("warn", || { + emit_websocket_invocations( + &L7EvalContext::default(), + &[WebSocketInvocation { + config_name: "guard".to_string(), + implementation: "test/guard".to_string(), + outcome, + sequence: None, + original_size: 0, + replacement_size: None, + transformed: false, + failed: true, + stage_disabled: false, + reason_code: None, + }], + ); + }) + .await; + let finding = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.websocket_failure" + }) + .unwrap(); + assert_eq!(finding["action_id"].as_u64(), action_id, "{outcome:?}"); + } + } + + #[test] + fn refusal_findings_record_the_denial() { + for reason in [ + "middleware_failed: guard", + "transformed_body_policy_evaluation_failed: unavailable", + ] { + let events = middleware_events( + &L7EvalContext::default(), + &request(), + &outcome(false, reason, vec![], vec![]), + ); + assert_eq!(events.len(), 1, "{reason}"); + let finding = events[0].to_json().unwrap(); + assert_eq!(finding["class_uid"], 2004); + assert_eq!(finding["action_id"], 2, "{reason}"); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn inspection_refusals_record_denial_but_fail_open_findings_do_not() { + for denied in [false, true] { + let (events, received) = exported("warn", || { + let ctx = L7EvalContext::default(); + emit_middleware_uninspectable(&ctx, "unknown protocol", denied); + emit_middleware_body_unavailable(&ctx, denied); + }) + .await; + assert_eq!(events.len(), 2); + for (event, uid) in events.iter().zip([ + "openshell.middleware.traffic_uninspectable", + "openshell.middleware.body_unavailable", + ]) { + assert_eq!(event["finding_info"]["uid"], uid); + assert_eq!(event["class_uid"], 2004); + assert_eq!(event["action_id"].as_u64(), denied.then_some(2)); + assert_eq!(event["action"].as_str(), denied.then_some("Denied")); + if !denied { + assert!(event.get("action_id").is_none()); + assert!(event.get("action").is_none()); + } + } + // A finding-only refusal still creates no HTTP deny span. + assert_no_deny(&events, &received); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn session_capacity_findings_follow_the_preflight_outcome() { + for allowed in [true, false] { + let (events, received) = exported("warn", || { + emit_websocket_preflight_events( + &L7EvalContext::default(), + &openshell_supervisor_middleware::WebSocketPreflightResult { + allowed, + terminal_reason: None, + reason: "middleware_session_capacity_exhausted".into(), + denial: None, + session: None, + findings: vec![], + metadata: std::collections::BTreeMap::new(), + invocations: vec![], + coverage: vec![], + saturated: false, + session_capacity_exhausted: true, + }, + ); + }) + .await; + assert_eq!(events.len(), 1); + assert_eq!( + events[0]["finding_info"]["uid"], + "openshell.middleware.session_capacity_exhausted" + ); + assert_eq!(events[0]["action_id"].as_u64(), (!allowed).then_some(2)); + assert_eq!(events[0]["action"].as_str(), (!allowed).then_some("Denied")); + if allowed { + assert!(events[0].get("action_id").is_none()); + assert!(events[0].get("action").is_none()); + } + assert_no_deny(&events, &received); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn http_chain_outcomes_group_findings_and_preserve_allowed_controls() { + for allowed in [true, false] { + let (events, received) = exported("warn", || { + let invocation = MiddlewareInvocation { + name: "guard".to_string(), + implementation: "test/guard".to_string(), + decision: if allowed { + openshell_core::proto::Decision::Allow + } else { + openshell_core::proto::Decision::Deny + }, + transformed: false, + failed: false, + }; + let reason = if allowed { + "allowed" + } else { + "middleware_failed: guard" + }; + emit_middleware_events( + &L7EvalContext::default(), + &request(), + &outcome(allowed, reason, vec![invocation], vec![finding()]), + ); + }) + .await; + assert!(events.len() >= 2); + if allowed { + assert_no_deny(&events, &received); + } else { + assert_eq!(deny_spans(&received).len(), 1); + assert_deny_resolves(&events, &received, true); + } + } } } @@ -1026,6 +1241,10 @@ mod tests { let serialized = serde_json::to_string(&middleware_admission_exhausted_event(&ctx)) .expect("serialize admission event"); + let event: serde_json::Value = serde_json::from_str(&serialized).unwrap(); + assert_eq!(event["class_uid"], 2004); + assert_eq!(event["action_id"], 2); + assert_eq!(event["action"], "Denied"); assert!(serialized.contains("openshell.middleware.admission_exhausted")); assert!(serialized.contains("api-policy")); assert!(serialized.contains("api.example.test")); diff --git a/crates/openshell-supervisor-network/src/l7/mod.rs b/crates/openshell-supervisor-network/src/l7/mod.rs index 37849b9c0c..bc01d0bbdd 100644 --- a/crates/openshell-supervisor-network/src/l7/mod.rs +++ b/crates/openshell-supervisor-network/src/l7/mod.rs @@ -417,7 +417,7 @@ pub fn parse_l7_config(val: ®orus::Value) -> Option { "rejecting endpoint: unrecognized credential_signing value {other:?}" )) .build(); - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); return None; } _ => CredentialSigning::None, @@ -433,7 +433,7 @@ pub fn parse_l7_config(val: ®orus::Value) -> Option { .state(openshell_ocsf::StateId::Disabled, "invalid") .message("rejecting endpoint: credential_signing requires signing_service".to_string()) .build(); - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); return None; } @@ -462,6 +462,7 @@ pub fn parse_l7_config(val: ®orus::Value) -> Option { pub(crate) fn emit_uninspected_credential_finding(host: &str, policy_name: &str, surface: &str) { let event = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.credentials.traffic_uninspectable", @@ -475,7 +476,7 @@ pub(crate) fn emit_uninspected_credential_finding(host: &str, policy_name: &str, ]) .message("Uninspected credential-bearing traffic denied") .build(); - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); } impl L7EndpointConfig { diff --git a/crates/openshell-supervisor-network/src/l7/relay.rs b/crates/openshell-supervisor-network/src/l7/relay.rs index b4acb5e52f..fa20252714 100644 --- a/crates/openshell-supervisor-network/src/l7/relay.rs +++ b/crates/openshell-supervisor-network/src/l7/relay.rs @@ -20,6 +20,7 @@ use crate::l7::provider::{L7Provider, RelayOutcome}; use crate::l7::rest::WebSocketExtensionMode; use crate::l7::{EndpointObserver, EnforcementMode, L7EndpointConfig, L7Protocol, L7RequestInfo}; use crate::opa::{PolicyGenerationGuard, TunnelPolicyEngine}; +use crate::telemetry::egress_emit; use miette::{IntoDiagnostic, Result, miette}; use openshell_core::activity::{ActivitySender, try_record_activity}; use openshell_core::endpoint_status::{EndpointObservationSender, EndpointResult}; @@ -27,7 +28,6 @@ use openshell_core::secrets::{self, SecretResolver}; use openshell_ocsf::{ ActionId, ActivityId, DetectionFindingBuilder, DispositionId, Endpoint, FindingInfo, HttpActivityBuilder, HttpRequest, NetworkActivityBuilder, SeverityId, StatusId, Url as OcsfUrl, - ocsf_emit, }; #[cfg(test)] use std::collections::BTreeMap; @@ -287,8 +287,13 @@ where .into_diagnostic()?; client.flush().await.into_diagnostic()?; - ocsf_emit!(build_request_authority_mismatch_event(ctx, method)); - ocsf_emit!(build_request_authority_mismatch_finding(ctx)); + crate::telemetry::emit_decision( + [ + build_request_authority_mismatch_event(ctx, method), + build_request_authority_mismatch_finding(ctx), + ], + None, + ); Ok(()) } @@ -338,7 +343,7 @@ where crate::l7::mcp::selected_revision_context(request, version) ); let summary = l7_protocol_log_summary(None, Some(&info)); - ocsf_emit!(build_l7_request_event( + egress_emit!(build_l7_request_event( ctx, &request.action, redacted_target, @@ -419,7 +424,7 @@ where } let reason = error.rejection_detail(request); let summary = l7_protocol_log_summary(None, Some(info)); - ocsf_emit!(build_l7_request_event( + egress_emit!(build_l7_request_event( ctx, &request.action, redacted_target, @@ -616,8 +621,8 @@ where .into_diagnostic()?; client.flush().await.into_diagnostic()?; - if placement_mismatch { - ocsf_emit!( + let mut events = if placement_mismatch { + vec![ HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::for_http_method(method)) .http_request(method_only_request(method)) @@ -630,24 +635,24 @@ where .firewall_rule(&ctx.policy_name, "credential-binding") .message("Credential use denied: unauthorized request location") .status_detail("credential_placement_mismatch") - .build() - ); - ocsf_emit!(crate::l7::build_credential_placement_mismatch_finding( - &ctx.policy_name, - &ctx.host, - None, - )); + .build(), + crate::l7::build_credential_placement_mismatch_finding( + &ctx.policy_name, + &ctx.host, + None, + ), + ] } else { - ocsf_emit!(build_credential_resolution_event( + vec![build_credential_resolution_event( ctx, method, - endpoint_mismatch - )); - } - + endpoint_mismatch, + )] + }; if endpoint_mismatch { - ocsf_emit!(build_credential_endpoint_mismatch_finding(ctx)); + events.push(build_credential_endpoint_mismatch_finding(ctx)); } + crate::telemetry::emit_decision(events, None); Ok(()) } @@ -1041,7 +1046,7 @@ fn emit_parse_rejection(ctx: &L7EvalContext, detail: &str, engine_type: &str) { )) .status_detail(detail) .build(); - ocsf_emit!(event); + egress_emit!(event); emit_activity(ctx, true, "l7_parse_rejection"); } @@ -1157,7 +1162,7 @@ where .dst_endpoint(Endpoint::from_domain(&ctx.host, ctx.port)) .message("SQL L7 provider not yet implemented, falling back to passthrough") .build(); - ocsf_emit!(event); + egress_emit!(event); } tokio::io::copy_bidirectional(client, upstream) .await @@ -1690,7 +1695,7 @@ fn emit_l7_request_log( reason, protocol_summary, ); - ocsf_emit!(event); + egress_emit!(event); emit_activity(ctx, decision_str == "deny", "l7_policy"); } @@ -1856,7 +1861,7 @@ where } else { "raw bidirectional relay (L7 enforcement no longer active)" }; - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Other) .activity_name("Upgrade") @@ -2199,7 +2204,7 @@ where request_info.action, ctx.host, ctx.port, redacted_target, reason, )) .build(); - ocsf_emit!(event); + egress_emit!(event); } if allowed || config.enforcement == EnforcementMode::Audit { @@ -2407,7 +2412,7 @@ pub(crate) fn emit_policy_reload( port: u16, policy_name: &str, ) { - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -2627,7 +2632,7 @@ where &reason, )) .build(); - ocsf_emit!(event); + egress_emit!(event); } if allowed || (config.enforcement == EnforcementMode::Audit && !force_deny) { @@ -2909,7 +2914,7 @@ where request_info.action, ctx.host, ctx.port, redacted_target, reason, )) .build(); - ocsf_emit!(event); + egress_emit!(event); } if allowed || (config.enforcement == EnforcementMode::Audit && !force_deny) { @@ -3380,7 +3385,7 @@ fn emit_transformed_body_decision( request_info.action, ctx.host, ctx.port, request_info.target, reason )) .build(); - ocsf_emit!(event); + egress_emit!(event); } fn jsonrpc_policy_input(info: &crate::l7::jsonrpc::JsonRpcRequestInfo) -> serde_json::Value { @@ -3613,7 +3618,7 @@ where req.action, ctx.host, ctx.port, redacted_target, )) .build(); - ocsf_emit!(event); + egress_emit!(event); } let request_id = uuid::Uuid::new_v4().to_string(); @@ -3785,6 +3790,67 @@ where Ok(()) } +#[cfg(test)] +mod trace_tests { + use super::*; + use crate::telemetry::tests::{assert_deny_resolves, exported}; + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn authority_mismatch_domain_and_finding_share_one_trace() { + let (events, received) = exported("warn", || { + let ctx = L7EvalContext { + host: "blocked.example".to_string(), + port: 443, + ..Default::default() + }; + let mut response = Vec::new(); + // The in-memory span processor exports with a futures executor. + tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on(reject_request_authority_mismatch( + &mut response, + &ctx, + "POST", + )) + }) + .unwrap(); + assert!(response.starts_with(b"HTTP/1.1 403 Forbidden")); + }) + .await; + assert_eq!(events.len(), 2); + assert_eq!(received.spans.len(), 1); + assert_deny_resolves(&events, &received, true); + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn default_level_l7_relay_deny_uid_resolves_to_one_span_root_trace() { + let (events, received) = crate::telemetry::tests::exported_over_otlp("warn", || { + let ctx = L7EvalContext { + host: "blocked.example".to_string(), + port: 443, + policy_name: "rest-policy".to_string(), + ..Default::default() + }; + egress_emit!(build_l7_request_event( + &ctx, "GET", "/", "deny", "l7-rest", "denied", None + )); + }) + .await; + assert_eq!(events.len(), 1); + assert_deny_resolves(&events, &received, true); + assert_eq!(received.spans.len(), 1); + crate::telemetry::tests::assert_deny_attribute( + &received, + "openshell.policy.name", + "rest-policy", + ); + crate::telemetry::tests::assert_deny_attribute( + &received, + "server.address", + "blocked.example", + ); + } +} + #[cfg(test)] mod tests { use super::*; diff --git a/crates/openshell-supervisor-network/src/l7/rest.rs b/crates/openshell-supervisor-network/src/l7/rest.rs index 7a6a0d6236..97c71f09b3 100644 --- a/crates/openshell-supervisor-network/src/l7/rest.rs +++ b/crates/openshell-supervisor-network/src/l7/rest.rs @@ -1184,7 +1184,7 @@ where port = options.port, )) .build(); - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); } _ => { return Err(miette::Report::new(CredentialUnavailableError::new( @@ -1534,8 +1534,9 @@ fn emit_uninspected_body_credential_denial( req.action, options.host, options.port )) .build(); - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.credentials.traffic_uninspectable", @@ -1548,7 +1549,7 @@ fn emit_uninspected_body_credential_denial( ]) .message("Request body credential placeholder denied") .build(); - openshell_ocsf::ocsf_emit!(finding); + crate::telemetry::egress_emit!(finding); } struct PreparedRequestBody { @@ -6916,6 +6917,256 @@ mod tests { (outcome, delivered) } + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_trace_failure_records_share_the_terminal_decision() { + use crate::telemetry::tests::{assert_deny_resolves, deny_spans, exported}; + + // This relay fixture has no CONNECT span, so denies are roots at both + // levels. The thread-local export harness observes the relay task; + // emissions in spawned tasks would need explicit subscriber propagation. + for level in ["warn", "debug"] { + for (method, script) in [ + ("GET", ResponseRelayScript::BlockStream), + ("GET", ResponseRelayScript::InvalidBodySequence), + ("GET", ResponseRelayScript::InvalidWholeBodySequence), + ("HEAD", ResponseRelayScript::WholeBody), + ] { + let (events, received) = exported(level, || { + let (outcome, delivered) = tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on(run_response_middleware_relay( + b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello", + method, + script, + )) + }); + if method == "HEAD" + || matches!(script, ResponseRelayScript::InvalidWholeBodySequence) + { + assert!(matches!(outcome.unwrap(), RelayOutcome::Consumed)); + assert!(delivered.starts_with(b"HTTP/1.1 502 Bad Gateway\r\n")); + } else { + assert!(outcome.is_err()); + assert!(delivered.starts_with(b"HTTP/1.1 200 OK\r\n")); + assert!(!String::from_utf8_lossy(&delivered).contains("502 Bad Gateway")); + } + }) + .await; + let terminal = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.http_response_failure" + }) + .expect("terminal delivery failure is recorded"); + let companions: Vec<_> = events + .iter() + .filter(|event| { + event.get("finding_info").is_some() + || event["unmapped"]["failed"] == true + || event["action_id"] == openshell_ocsf::ActionId::Denied as u8 + }) + .cloned() + .collect(); + assert!(companions.len() >= 2, "failure includes diagnostic records"); + assert_eq!( + deny_spans(&received).len(), + 1, + "one response stop is one exported decision" + ); + assert!(terminal.get("trace").is_none()); + assert_deny_resolves(&companions, &received, true); + } + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn credential_refusal_findings_record_denial_without_http_spans() { + let request = L7Request { + action: "POST".into(), + target: "/api".into(), + query_params: HashMap::new(), + raw_header: vec![], + body_length: BodyLength::None, + }; + let (events, received) = crate::telemetry::tests::exported("warn", || { + crate::l7::emit_uninspected_credential_finding("example.test", "p", "test"); + emit_uninspected_body_credential_denial( + &request, + &RelayRequestOptions { + host: "example.test", + port: 443, + ..Default::default() + }, + BodyCredentialError::KnownUnavailable, + ); + }) + .await; + assert_eq!(events.len(), 3); + assert_eq!( + events + .iter() + .filter(|event| event["class_uid"] == 2004) + .count(), + 2 + ); + for event in &events { + assert_eq!(event["action_id"], 2); + assert_eq!(event["action"], "Denied"); + } + crate::telemetry::tests::assert_no_deny(&events, &received); + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_trace_upstream_io_failure_is_not_an_enforced_denial() { + struct FailedReader; + impl AsyncRead for FailedReader { + fn poll_read( + self: Pin<&mut Self>, + _cx: &mut Context<'_>, + _buf: &mut ReadBuf<'_>, + ) -> Poll> { + Poll::Ready(Err(std::io::Error::new( + std::io::ErrorKind::ConnectionReset, + "upstream response interrupted", + ))) + } + } + + for script in [ResponseRelayScript::Stream, ResponseRelayScript::WholeBody] { + let (events, received) = crate::telemetry::tests::exported("warn", || { + tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on(async { + let (runner, chain) = response_middleware_fixture(script); + let mut upstream = b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\n" + .as_slice() + .chain(FailedReader); + let mut delivered = Vec::new(); + let outcome = relay_response( + "GET", + &mut upstream, + &mut delivered, + RelayResponseOptions::default(), + Some(response_middleware_context(&runner, &chain, "GET")), + ) + .await; + if matches!(script, ResponseRelayScript::Stream) { + assert!(outcome.is_err()); + assert!(delivered.starts_with(b"HTTP/1.1 200 OK\r\n")); + assert!( + !String::from_utf8_lossy(&delivered).contains("502 Bad Gateway") + ); + } else { + assert!(matches!(outcome.unwrap(), RelayOutcome::Consumed)); + assert!(delivered.starts_with(b"HTTP/1.1 502 Bad Gateway\r\n")); + } + }); + }); + }) + .await; + let finding = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.http_response_failure" + }) + .expect("upstream I/O failure retains its diagnostic finding"); + assert!(finding.get("action_id").is_none()); + assert!(finding.get("action").is_none()); + crate::telemetry::tests::assert_no_deny(&events, &received); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_trace_downstream_body_failure_is_not_an_enforced_denial() { + #[derive(Default)] + struct DisconnectAfterHead(Vec); + impl AsyncWrite for DisconnectAfterHead { + fn poll_write( + mut self: Pin<&mut Self>, + _cx: &mut Context<'_>, + buf: &[u8], + ) -> Poll> { + if self.0.ends_with(b"\r\n\r\n") { + return Poll::Ready(Err(std::io::Error::new( + std::io::ErrorKind::BrokenPipe, + "client disconnected", + ))); + } + self.0.extend_from_slice(buf); + Poll::Ready(Ok(buf.len())) + } + fn poll_flush( + self: Pin<&mut Self>, + _cx: &mut Context<'_>, + ) -> Poll> { + Poll::Ready(Ok(())) + } + fn poll_shutdown( + self: Pin<&mut Self>, + _cx: &mut Context<'_>, + ) -> Poll> { + Poll::Ready(Ok(())) + } + } + + let (events, received) = crate::telemetry::tests::exported("warn", || { + tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on(async { + let (runner, chain) = response_middleware_fixture(ResponseRelayScript::Stream); + let mut upstream = + b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello".as_slice(); + let mut delivered = DisconnectAfterHead::default(); + let outcome = relay_response( + "GET", + &mut upstream, + &mut delivered, + RelayResponseOptions::default(), + Some(response_middleware_context(&runner, &chain, "GET")), + ) + .await; + assert!(outcome.is_err()); + assert!(delivered.0.starts_with(b"HTTP/1.1 200 OK\r\n")); + assert!(!String::from_utf8_lossy(&delivered.0).contains("502 Bad Gateway")); + }); + }); + }) + .await; + let finding = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.http_response_failure" + }) + .expect("downstream I/O failure retains its diagnostic finding"); + assert!(finding.get("action_id").is_none()); + assert!(finding.get("action").is_none()); + crate::telemetry::tests::assert_no_deny(&events, &received); + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_trace_allowed_and_fail_open_controls_do_not_create_deny_spans() { + for script in [ + ResponseRelayScript::Stream, + ResponseRelayScript::InvalidBodySequence, + ResponseRelayScript::InvalidWholeBodySequence, + ] { + let (events, received) = crate::telemetry::tests::exported("warn", || { + let (outcome, delivered) = tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on( + run_response_middleware_relay_with_error( + b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello", + "GET", + script, + openshell_supervisor_middleware::OnError::FailOpen, + ), + ) + }); + assert!(outcome.is_ok()); + assert!(delivered.starts_with(b"HTTP/1.1 200 OK\r\n")); + }) + .await; + assert!(!events.is_empty()); + crate::telemetry::tests::assert_no_deny(&events, &received); + } + } + #[tokio::test] async fn response_middleware_headers_only_mutates_head_and_preserves_framing() { let (outcome, delivered) = run_response_middleware_relay( diff --git a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs index 3efc323bdb..0113dc4323 100644 --- a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs +++ b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs @@ -408,16 +408,27 @@ where allowed = preflight.allowed, "HTTP response middleware preflight completed" ); - for event in crate::l7::middleware::middleware_finding_events(&preflight.findings) { - openshell_ocsf::ocsf_emit!(event); - } + let mut preflight_events = + crate::l7::middleware::middleware_finding_events(&preflight.findings); if !preflight.allowed { - emit_http_response_middleware_invocations( + preflight_events.extend(http_response_decision_events( middleware.policy_name, &middleware.target, status_code, &preflight.invocations, - ); + )); + if preflight.denial.is_none() { + preflight_events.push(http_response_middleware_failure_event( + middleware.policy_name, + &middleware.target, + status_code, + false, + true, + )); + } + } + crate::telemetry::emit_decision(preflight_events, None); + if !preflight.allowed { if let Some(denial) = preflight.denial.as_ref() { send_response_middleware_denial( client, @@ -428,12 +439,6 @@ where ) .await?; } else { - emit_http_response_middleware_failure( - middleware.policy_name, - &middleware.target, - status_code, - false, - ); send_response_delivery_failure( client, request_method, @@ -444,11 +449,14 @@ where } return Ok(Some(RelayOutcome::Consumed)); } - emit_http_response_middleware_invocations( - middleware.policy_name, - &middleware.target, - status_code, - &preflight.invocations, + crate::telemetry::emit_decision( + http_response_decision_events( + middleware.policy_name, + &middleware.target, + status_code, + &preflight.invocations, + ), + None, ); let Some(mut session) = preflight.session else { @@ -482,12 +490,21 @@ where Ok(finish) => finish, Err(error) => { debug!(error = %error, "HTTP response middleware finalization failed"); - emit_http_response_diagnostics( + let mut events = http_response_diagnostic_events( middleware.policy_name, &middleware.target, status_code, - &error.diagnostics, + &error.diagnostics.invocations, + &error.diagnostics.findings, ); + events.push(http_response_middleware_failure_event( + middleware.policy_name, + &middleware.target, + status_code, + false, + true, + )); + crate::telemetry::emit_decision(events, None); send_response_delivery_failure( client, request_method, @@ -502,15 +519,16 @@ where guard.ensure_current()?; } let mut headers = preflight.headers; - emit_http_response_middleware_invocations( - middleware.policy_name, - &middleware.target, - status_code, - &finish.invocations, + crate::telemetry::emit_decision( + http_response_diagnostic_events( + middleware.policy_name, + &middleware.target, + status_code, + &finish.invocations, + &finish.findings, + ), + None, ); - for event in crate::l7::middleware::middleware_finding_events(&finish.findings) { - openshell_ocsf::ocsf_emit!(event); - } if finish.strip_stale_integrity_headers { strip_response_integrity_headers(&mut headers); } @@ -610,13 +628,30 @@ where openshell_core::proto::MiddlewareSessionEndReason::UpstreamDisconnect }; session.end(end_reason).await; - if committed { - emit_http_response_middleware_failure( + // Diagnostics from a middleware stop and its terminal finding are + // one decision. Transport/framing errors still record delivery + // failure, but do not imply an enforced middleware refusal. + let mut events = middleware_stop.map_or_else(Vec::new, |stop| { + http_response_diagnostic_events( middleware.policy_name, &middleware.target, status_code, - true, - ); + &stop.diagnostics.invocations, + &stop.diagnostics.findings, + ) + }); + // A denial sent before commitment is reported by its invocation. + if committed || middleware_stop.is_none_or(|stop| stop.failure.denial.is_none()) { + events.push(http_response_middleware_failure_event( + middleware.policy_name, + &middleware.target, + status_code, + committed, + middleware_stop.is_some(), + )); + } + crate::telemetry::emit_decision(events, None); + if committed { return Err(error); } debug!(error = %error, "HTTP response processing failed before commitment"); @@ -630,12 +665,6 @@ where ) .await?; } else { - emit_http_response_middleware_failure( - middleware.policy_name, - &middleware.target, - status_code, - false, - ); send_response_delivery_failure( client, request_method, @@ -660,19 +689,24 @@ where let finish = match session.finish(trailers).await { Ok(finish) => finish, Err(error) => { - emit_http_response_diagnostics( + let mut events = http_response_diagnostic_events( middleware.policy_name, &middleware.target, status_code, - &error.diagnostics, + &error.diagnostics.invocations, + &error.diagnostics.findings, ); - if committed { - emit_http_response_middleware_failure( + if committed || error.denial.is_none() { + events.push(http_response_middleware_failure_event( middleware.policy_name, &middleware.target, status_code, + committed, true, - ); + )); + } + crate::telemetry::emit_decision(events, None); + if committed { return Err(miette!( "HTTP response middleware failed after commitment: {error}" )); @@ -688,12 +722,6 @@ where ) .await?; } else { - emit_http_response_middleware_failure( - middleware.policy_name, - &middleware.target, - status_code, - false, - ); send_response_delivery_failure( client, request_method, @@ -708,15 +736,16 @@ where if let Some(guard) = middleware.generation_guard { guard.ensure_current()?; } - emit_http_response_middleware_invocations( - middleware.policy_name, - &middleware.target, - status_code, - &finish.invocations, + crate::telemetry::emit_decision( + http_response_diagnostic_events( + middleware.policy_name, + &middleware.target, + status_code, + &finish.invocations, + &finish.findings, + ), + None, ); - for event in crate::l7::middleware::middleware_finding_events(&finish.findings) { - openshell_ocsf::ocsf_emit!(event); - } if whole_body && !committed { let mut headers = preflight.headers; @@ -861,29 +890,39 @@ where }) } -fn emit_http_response_middleware_invocations( +fn http_response_decision_events( policy_name: &str, target: &HttpRequestTarget, status_code: u16, invocations: &[openshell_supervisor_middleware::HttpResponseInvocation], -) { - for event in - http_response_middleware_invocation_events(policy_name, target, status_code, invocations) - { - openshell_ocsf::ocsf_emit!(event); - } +) -> Vec { + let mut events = + http_response_middleware_invocation_events(policy_name, target, status_code, invocations); for invocation in invocations { - if let Some(event) = - http_response_middleware_fail_open_finding_event(policy_name, target, invocation) - { - openshell_ocsf::ocsf_emit!(event); - } - if let Some(event) = - http_response_middleware_block_finding_event(policy_name, target, invocation) - { - openshell_ocsf::ocsf_emit!(event); - } - } + events.extend(http_response_middleware_fail_open_finding_event( + policy_name, + target, + invocation, + )); + events.extend(http_response_middleware_block_finding_event( + policy_name, + target, + invocation, + )); + } + events +} + +fn http_response_diagnostic_events( + policy_name: &str, + target: &HttpRequestTarget, + status_code: u16, + invocations: &[openshell_supervisor_middleware::HttpResponseInvocation], + findings: &[openshell_supervisor_middleware::NamespacedFinding], +) -> Vec { + let mut events = http_response_decision_events(policy_name, target, status_code, invocations); + events.extend(crate::l7::middleware::middleware_finding_events(findings)); + events } fn emit_http_response_diagnostics( @@ -892,15 +931,16 @@ fn emit_http_response_diagnostics( status_code: u16, diagnostics: &openshell_supervisor_middleware::HttpResponseDiagnostics, ) { - emit_http_response_middleware_invocations( - policy_name, - target, - status_code, - &diagnostics.invocations, + crate::telemetry::emit_decision( + http_response_diagnostic_events( + policy_name, + target, + status_code, + &diagnostics.invocations, + &diagnostics.findings, + ), + None, ); - for event in crate::l7::middleware::middleware_finding_events(&diagnostics.findings) { - openshell_ocsf::ocsf_emit!(event); - } } pub(super) fn http_response_middleware_invocation_events( @@ -914,8 +954,11 @@ pub(super) fn http_response_middleware_invocation_events( .map(|invocation| { let outcome = format!("{:?}", invocation.outcome).to_ascii_lowercase(); let failed = invocation.failed; - let blocked = invocation.outcome - == openshell_supervisor_middleware::HttpResponseInvocationOutcome::BlockDelivery; + let blocked = matches!( + invocation.outcome, + openshell_supervisor_middleware::HttpResponseInvocationOutcome::BlockDelivery + | openshell_supervisor_middleware::HttpResponseInvocationOutcome::FailClosed + ); openshell_ocsf::HttpActivityBuilder::new(ocsf_ctx()) .activity(openshell_ocsf::ActivityId::Other) .action(if blocked { @@ -991,6 +1034,7 @@ fn http_response_middleware_block_finding_event( } Some( openshell_ocsf::DetectionFindingBuilder::new(ocsf_ctx()) + .action(openshell_ocsf::ActionId::Denied) .severity(openshell_ocsf::SeverityId::Medium) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.middleware.http_response_blocked", @@ -1068,8 +1112,28 @@ fn emit_http_response_middleware_failure( status_code: u16, committed: bool, ) { + crate::telemetry::egress_emit!(http_response_middleware_failure_event( + policy_name, + target, + status_code, + committed, + true, + )); +} + +fn http_response_middleware_failure_event( + policy_name: &str, + target: &HttpRequestTarget, + status_code: u16, + committed: bool, + denied: bool, +) -> openshell_ocsf::OcsfEvent { let status_code = status_code.to_string(); - let event = openshell_ocsf::DetectionFindingBuilder::new(ocsf_ctx()) + let mut builder = openshell_ocsf::DetectionFindingBuilder::new(ocsf_ctx()); + if denied { + builder = builder.action(openshell_ocsf::ActionId::Denied); + } + builder .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.middleware.http_response_failure", @@ -1093,8 +1157,7 @@ fn emit_http_response_middleware_failure( } else { "HTTP response middleware failed before response commitment" }) - .build(); - openshell_ocsf::ocsf_emit!(event); + .build() } #[derive(Debug)] @@ -1627,11 +1690,18 @@ struct ResponseOutputState<'a> { #[derive(Debug)] struct ResponseMiddlewareStop { failure: openshell_supervisor_middleware::HttpResponseMiddlewareFailure, + diagnostics: openshell_supervisor_middleware::HttpResponseDiagnostics, } impl ResponseMiddlewareStop { - fn new(failure: openshell_supervisor_middleware::HttpResponseMiddlewareFailure) -> Self { - Self { failure } + fn new( + failure: openshell_supervisor_middleware::HttpResponseMiddlewareFailure, + diagnostics: openshell_supervisor_middleware::HttpResponseDiagnostics, + ) -> Self { + Self { + failure, + diagnostics, + } } } @@ -1676,13 +1746,15 @@ async fn expire_whole_body_deadline( guard.ensure_current()?; } let diagnostics = session.take_diagnostics(); - emit_http_response_diagnostics( - framing.policy_name, - framing.target, - framing.status_code, - &diagnostics, - ); - let output = output.map_err(ResponseMiddlewareStop::new)?; + if output.is_ok() { + emit_http_response_diagnostics( + framing.policy_name, + framing.target, + framing.status_code, + &diagnostics, + ); + } + let output = output.map_err(|failure| ResponseMiddlewareStop::new(failure, diagnostics))?; deliver_response_units(client, output, framing, session.requires_whole_body()).await } @@ -1818,13 +1890,15 @@ async fn process_response_unit( guard.ensure_current()?; } let diagnostics = session.take_diagnostics(); - emit_http_response_diagnostics( - framing.policy_name, - framing.target, - framing.status_code, - &diagnostics, - ); - let output = output.map_err(ResponseMiddlewareStop::new)?; + if output.is_ok() { + emit_http_response_diagnostics( + framing.policy_name, + framing.target, + framing.status_code, + &diagnostics, + ); + } + let output = output.map_err(|failure| ResponseMiddlewareStop::new(failure, diagnostics))?; deliver_response_units(client, output, framing, session.requires_whole_body()).await } @@ -2081,6 +2155,137 @@ pub(super) fn response_is_event_stream(headers: &str) -> bool { #[cfg(test)] mod tests { + use openshell_supervisor_middleware::{ + HttpResponseInvocation, HttpResponseInvocationOutcome as Outcome, NamespacedFinding, + }; + + fn invocation(outcome: Outcome, failed: bool) -> HttpResponseInvocation { + HttpResponseInvocation { + config_name: "guard".to_string(), + implementation: "test/guard".to_string(), + outcome, + sequence: None, + input_size: 0, + output_size: None, + failed, + stage_disabled: false, + reason_code: None, + failure_category: None, + } + } + + fn finding() -> NamespacedFinding { + NamespacedFinding { + middleware: "guard".to_string(), + finding: openshell_core::proto::Finding { + r#type: "test.finding".to_string(), + label: "Test finding".to_string(), + count: 1, + severity: "high".to_string(), + ..Default::default() + }, + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_terminal_failure_without_diagnostics_has_no_deny_trace() { + use crate::telemetry::tests::{assert_no_deny, exported}; + + // Platform refusals can lack invocation diagnostics, but must retain + // their terminal failure record. Without an HTTP record, no deny span. + for committed in [false, true] { + let (events, received) = exported("warn", || { + super::emit_http_response_middleware_failure( + "response-policy", + &super::HttpRequestTarget::default(), + 200, + committed, + ); + }) + .await; + + assert_eq!(events.len(), 1, "only the terminal failure is emitted"); + assert_eq!( + events[0]["finding_info"]["uid"], + "openshell.middleware.http_response_failure" + ); + assert_no_deny(&events, &received); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_diagnostic_findings_share_a_deny_span_only_when_delivery_is_denied() { + use crate::telemetry::tests::{assert_deny_resolves, assert_no_deny, exported}; + + for denied in [false, true] { + let (events, received) = exported("warn", || { + let outcome = if denied { + Outcome::BlockDelivery + } else { + Outcome::PassThrough + }; + let diagnostics = openshell_supervisor_middleware::HttpResponseDiagnostics { + invocations: vec![invocation(outcome, false)], + findings: vec![finding()], + ..Default::default() + }; + super::emit_http_response_diagnostics( + "response-policy", + &super::HttpRequestTarget::default(), + 200, + &diagnostics, + ); + }) + .await; + // A blocking invocation adds its own block finding. + assert_eq!(events.len(), if denied { 3 } else { 2 }); + if denied { + let blocked = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.http_response_blocked" + }) + .expect("blocked delivery emits its refusal finding"); + assert_eq!(blocked["action_id"], 2); + assert_eq!(blocked["action"], "Denied"); + assert_eq!(received.spans.len(), 1); + assert_deny_resolves(&events, &received, true); + } else { + assert_no_deny(&events, &received); + } + } + } + + #[test] + fn fail_closed_invocations_and_enforced_failures_record_the_denial() { + let target = super::HttpRequestTarget::default(); + for (outcome, failed, action_id) in [ + (Outcome::BlockDelivery, false, 2), + (Outcome::FailClosed, true, 2), + (Outcome::FailOpen, true, 99), + (Outcome::PassThrough, false, 1), + ] { + let events = super::http_response_middleware_invocation_events( + "p", + &target, + 200, + &[invocation(outcome, failed)], + ); + assert_eq!( + events[0].to_json().unwrap()["action_id"], + action_id, + "{outcome:?}" + ); + } + for denied in [false, true] { + let failure = + super::http_response_middleware_failure_event("p", &target, 200, false, denied) + .to_json() + .unwrap(); + assert_eq!(failure["action_id"] == 2, denied); + } + } + use super::{ ResponseFraming, parse_connection_keep_alive, parse_response_head_for_middleware, response_is_http_10, serialize_response_head, diff --git a/crates/openshell-supervisor-network/src/l7/token_grant_injection.rs b/crates/openshell-supervisor-network/src/l7/token_grant_injection.rs index 65d7b70d08..f868575097 100644 --- a/crates/openshell-supervisor-network/src/l7/token_grant_injection.rs +++ b/crates/openshell-supervisor-network/src/l7/token_grant_injection.rs @@ -22,12 +22,13 @@ use openshell_core::token_grant_failure::{ }; use openshell_ocsf::{ ActionId, ActivityId, DispositionId, Endpoint, HttpActivityBuilder, HttpRequest, SeverityId, - StatusId, ctx::ctx as ocsf_ctx, ocsf_emit, + StatusId, ctx::ctx as ocsf_ctx, }; use tracing::warn; use crate::l7::provider::L7Request; use crate::l7::relay::L7EvalContext; +use crate::telemetry::egress_emit; /// Borrowed grant configuration for one endpoint-bound provider credential. pub struct TokenGrantRequest<'a> { @@ -340,7 +341,7 @@ fn report_refused_grant( .map_or_else(|| "none".to_string(), |status| status.to_string()), "Token grant failed" ); - ocsf_emit!( + egress_emit!( HttpActivityBuilder::new(ocsf_ctx()) .activity(ActivityId::Fail) .action(ActionId::Denied) @@ -398,7 +399,7 @@ async fn inject_selected( inject_header(&raw_header, &name, &value).map_err(TokenGrantInjectionError::new)?; } for (provider_key, _) in credentials { - ocsf_emit!( + egress_emit!( HttpActivityBuilder::new(ocsf_ctx()) .activity(ActivityId::Other) .action(ActionId::Allowed) diff --git a/crates/openshell-supervisor-network/src/l7/websocket.rs b/crates/openshell-supervisor-network/src/l7/websocket.rs index 5370e383c3..4d688929c6 100644 --- a/crates/openshell-supervisor-network/src/l7/websocket.rs +++ b/crates/openshell-supervisor-network/src/l7/websocket.rs @@ -9,13 +9,13 @@ use crate::l7::relay::{L7EvalContext, evaluate_l7_request}; use crate::l7::{EnforcementMode, L7RequestInfo}; use crate::opa::{PolicyGenerationGuard, TunnelPolicyEngine}; +use crate::telemetry::egress_emit; use flate2::{Compress, Compression, Decompress, FlushCompress, FlushDecompress, Status}; use miette::{IntoDiagnostic, Result, miette}; use openshell_core::provider_credentials::ProviderCredentialState; use openshell_core::secrets::{SecretResolver, contains_reserved_credential_marker}; use openshell_ocsf::{ ActionId, ActivityId, DispositionId, Endpoint, NetworkActivityBuilder, SeverityId, StatusId, - ocsf_emit, }; use std::collections::HashMap; use std::future::Future; @@ -584,7 +584,7 @@ where if let Err(termination) = &result { let error = termination.error.to_string(); if error.contains(CREDENTIAL_PLACEMENT_MISMATCH) { - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Fail) .action(ActionId::Denied) @@ -597,7 +597,7 @@ where .status_detail("credential_placement_mismatch") .build() ); - ocsf_emit!(crate::l7::build_credential_placement_mismatch_finding( + egress_emit!(crate::l7::build_credential_placement_mismatch_finding( options.policy_name, host, Some("websocket"), @@ -641,7 +641,7 @@ async fn write_policy_violation_close(writer: &mut W) -> } fn emit_credential_endpoint_mismatch(host: &str, port: u16, policy_name: &str) { - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Fail) .action(ActionId::Denied) @@ -656,7 +656,7 @@ fn emit_credential_endpoint_mismatch(host: &str, port: u16, policy_name: &str) { .status_detail("credential_endpoint_mismatch") .build() ); - ocsf_emit!(crate::l7::build_credential_endpoint_mismatch_finding( + egress_emit!(crate::l7::build_credential_endpoint_mismatch_finding( policy_name, host, Some("websocket"), @@ -1412,7 +1412,7 @@ fn emit_uninspected_credential_denial(host: &str, port: u16, policy_name: &str, "WebSocket credential traffic denied for {host}:{port}" )) .build(); - ocsf_emit!(event); + egress_emit!(event); crate::l7::emit_uninspected_credential_finding(host, policy_name, surface); } @@ -2087,7 +2087,7 @@ fn emit_rewrite_event(host: &str, port: u16, policy_name: &str, replacements: us .firewall_rule(policy_name, "l7-websocket") .message(rewrite_event_message(host, port, replacements)) .build(); - ocsf_emit!(event); + egress_emit!(event); } fn rewrite_event_message(host: &str, port: u16, replacements: usize) -> String { @@ -2140,7 +2140,7 @@ fn emit_websocket_l7_event( request_info.action, request_info.target, summary )) .build(); - ocsf_emit!(event); + egress_emit!(event); } fn observe_termination( @@ -2153,7 +2153,7 @@ fn observe_termination( emit_protocol_failure(host, port, policy_name, failure_class); } if termination.cause == WebSocketTerminationCause::CapacityExhausted { - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -2177,7 +2177,7 @@ fn emit_protocol_failure( policy_name: &str, failure_class: FrameFailureClass, ) { - ocsf_emit!(protocol_failure_event( + egress_emit!(protocol_failure_event( host, port, policy_name, diff --git a/crates/openshell-supervisor-network/src/lib.rs b/crates/openshell-supervisor-network/src/lib.rs index d9fcd004b6..74a6698b92 100644 --- a/crates/openshell-supervisor-network/src/lib.rs +++ b/crates/openshell-supervisor-network/src/lib.rs @@ -24,6 +24,7 @@ pub mod proxy; pub mod run; pub mod sigv4; mod spiffe_endpoint; +mod telemetry; mod token_grant; pub mod upstream_proxy; diff --git a/crates/openshell-supervisor-network/src/opa.rs b/crates/openshell-supervisor-network/src/opa.rs index 2d1a73a949..e6ec6ead5f 100644 --- a/crates/openshell-supervisor-network/src/opa.rs +++ b/crates/openshell-supervisor-network/src/opa.rs @@ -145,7 +145,7 @@ fn emit_binary_identity_mode(require_binary_identity: bool, source: &str) { require_binary_identity, source, "Configured OPA runtime binary identity mode" ); - openshell_ocsf::ocsf_emit!( + crate::telemetry::egress_emit!( openshell_ocsf::ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(openshell_ocsf::SeverityId::Informational) .status(openshell_ocsf::StatusId::Success) @@ -1427,7 +1427,7 @@ fn parse_process_policy(val: ®orus::Value) -> ProcessPolicy { fn emit_l7_config_warnings(warnings: &[String], prefix: &str) { for w in warnings { - openshell_ocsf::ocsf_emit!( + crate::telemetry::egress_emit!( openshell_ocsf::ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(openshell_ocsf::SeverityId::Medium) .status(openshell_ocsf::StatusId::Success) diff --git a/crates/openshell-supervisor-network/src/policy_dns/mod.rs b/crates/openshell-supervisor-network/src/policy_dns/mod.rs index 5ddbd25cf4..4d5b61895d 100644 --- a/crates/openshell-supervisor-network/src/policy_dns/mod.rs +++ b/crates/openshell-supervisor-network/src/policy_dns/mod.rs @@ -35,10 +35,11 @@ pub(crate) use store::{ use crate::opa::OpaEngine; use crate::proxy::destination::{build_validation_plan, filter_resolved_addresses}; use crate::proxy::is_host_gateway_alias; +use crate::telemetry::egress_emit; use openshell_core::host_pattern::HostSelector; use openshell_ocsf::{ ActionId, ActivityId, ConfigStateChangeBuilder, DispositionId, Endpoint, - NetworkActivityBuilder, SeverityId, StateId, StatusId, ocsf_emit, + NetworkActivityBuilder, SeverityId, StateId, StatusId, }; use sha2::{Digest, Sha256}; use std::sync::Arc; @@ -493,7 +494,7 @@ fn dns_query_endpoint(name: &NormalizedName) -> Endpoint { } fn emit_dns_denial(name: &NormalizedName, detail: &str, message: &str) { - ocsf_emit!(build_dns_denial_event(name, detail, message)); + egress_emit!(build_dns_denial_event(name, detail, message)); } fn build_dns_denial_event( @@ -580,7 +581,7 @@ fn emit_dns_failure( detail: &str, message: &str, ) { - ocsf_emit!(build_dns_failure_event( + egress_emit!(build_dns_failure_event( name, family, eligible_endpoints, @@ -591,11 +592,11 @@ fn emit_dns_failure( } fn emit_mapping_publication(record: &ResolvedEndpointRecord) { - ocsf_emit!(build_mapping_publication_event(record)); + egress_emit!(build_mapping_publication_event(record)); } fn emit_observation_publication(record: &ResolvedEndpointRecord) { - ocsf_emit!(build_observation_publication_event(record)); + egress_emit!(build_observation_publication_event(record)); } fn build_observation_publication_event( diff --git a/crates/openshell-supervisor-network/src/policy_dns/runtime.rs b/crates/openshell-supervisor-network/src/policy_dns/runtime.rs index cf1f61cfca..d7888f991e 100644 --- a/crates/openshell-supervisor-network/src/policy_dns/runtime.rs +++ b/crates/openshell-supervisor-network/src/policy_dns/runtime.rs @@ -14,7 +14,7 @@ use futures::{FutureExt as _, StreamExt as _, stream::FuturesUnordered}; use miette::{IntoDiagnostic, Result, WrapErr}; use openshell_core::net::set_tcp_nodelay_best_effort; use openshell_isolation_interface::contract::{DnsTransport, PendingDnsQuery}; -use openshell_ocsf::{ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ocsf_emit}; +use openshell_ocsf::{ConfigStateChangeBuilder, SeverityId, StateId, StatusId}; use openshell_sandbox_backend::NetworkMediationSource; use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr}; use std::sync::Arc; @@ -169,7 +169,7 @@ impl PolicyDnsRuntime { let _ = expiry_store.expire(std::time::Instant::now()); } }); - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -284,7 +284,7 @@ impl PolicyDnsRuntime { } }); - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) diff --git a/crates/openshell-supervisor-network/src/policy_dns/store.rs b/crates/openshell-supervisor-network/src/policy_dns/store.rs index 9c76e89c5e..62fe1c19bf 100644 --- a/crates/openshell-supervisor-network/src/policy_dns/store.rs +++ b/crates/openshell-supervisor-network/src/policy_dns/store.rs @@ -433,7 +433,7 @@ impl ResolvedEndpointStore { if allocated.saturating_mul(5) >= capacity.saturating_mul(4) && !emitted.swap(true, Ordering::Relaxed) { - openshell_ocsf::ocsf_emit!(build_pool_high_water_event( + crate::telemetry::egress_emit!(build_pool_high_water_event( allocated, capacity, family, )); } diff --git a/crates/openshell-supervisor-network/src/policy_local.rs b/crates/openshell-supervisor-network/src/policy_local.rs index 033f492aa7..bdf8898986 100644 --- a/crates/openshell-supervisor-network/src/policy_local.rs +++ b/crates/openshell-supervisor-network/src/policy_local.rs @@ -12,7 +12,7 @@ use openshell_core::proto::{ SandboxPolicy as ProtoSandboxPolicy, }; use openshell_ocsf::{ - ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ocsf_emit, sanitize_reason_for_audit, + ConfigStateChangeBuilder, SeverityId, StateId, StatusId, sanitize_reason_for_audit, }; use serde::Deserialize; use std::collections::HashMap; @@ -721,7 +721,7 @@ async fn submit_proposal(ctx: &PolicyLocalContext, body: &[u8]) -> (u16, serde_j /// and the endpoint the agent is asking to reach — what a developer needs /// to see in the audit trace to correlate against the inbox card. fn emit_policy_propose_event(chunk_id: &str, summary: &str) { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -741,7 +741,7 @@ fn emit_policy_propose_event(chunk_id: &str, summary: &str) { fn emit_policy_decision_event(chunk: &PolicyChunk) { let summary = summarize_chunk_for_audit(chunk); match chunk.status.as_str() { - "approved" => ocsf_emit!( + "approved" => crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -763,7 +763,7 @@ fn emit_policy_decision_event(chunk: &PolicyChunk) { } else { format!("\"{sanitized}\"") }; - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Low) .status(StatusId::Success) diff --git a/crates/openshell-supervisor-network/src/proxy.rs b/crates/openshell-supervisor-network/src/proxy.rs index 85196d9f44..96c0b8f50a 100644 --- a/crates/openshell-supervisor-network/src/proxy.rs +++ b/crates/openshell-supervisor-network/src/proxy.rs @@ -8,6 +8,8 @@ mod egress; mod relay; #[cfg(test)] pub(crate) use relay::relay_inspected_http_stream_for_test; +#[cfg(test)] +mod trace_tests; #[cfg(test)] use openshell_sandbox_backend::test_support as rpc_test; @@ -19,6 +21,7 @@ use crate::policy_dns::{ MappingLookup, MappingLookupError, PolicyEndpointId, ResolvedEndpointStore, }; use crate::policy_local::{POLICY_LOCAL_HOST, PolicyLocalContext}; +use crate::telemetry::egress_emit; use crate::upstream_proxy::{self, UpstreamProxyConfig}; use futures::{FutureExt as _, StreamExt as _, stream::FuturesUnordered}; use http::StatusCode; @@ -44,7 +47,7 @@ use openshell_isolation_interface::contract::{ use openshell_ocsf::{ ActionId, ActivityId, BaseEventBuilder, DispositionId, Endpoint, HttpActivityBuilder, HttpRequest, HttpResponse, NetworkActivityBuilder, Process, SeverityId, StatusId, - Url as OcsfUrl, ocsf_emit, + Url as OcsfUrl, }; use openshell_sandbox_backend::NetworkMediationSource; use std::future::Future; @@ -244,16 +247,21 @@ fn build_credential_endpoint_mismatch_event( .build() } -fn emit_credential_endpoint_mismatch(method: &str, host: &str, port: u16, policy_name: &str) { +fn emit_credential_endpoint_mismatch( + method: &str, + host: &str, + port: u16, + policy_name: &str, + connect_span: &tracing::Span, +) { let event = build_credential_endpoint_mismatch_event(method, host, port, policy_name); - ocsf_emit!(event); let finding = crate::l7::build_credential_endpoint_mismatch_finding( policy_name, host, None, "Provider credential endpoint binding mismatch; request denied", ); - ocsf_emit!(finding); + crate::telemetry::emit_decision([event, finding], Some(connect_span)); } /// Hostnames injected by compute drivers as `/etc/hosts` aliases for the host @@ -349,7 +357,7 @@ impl ProxyHandle { format!("Proxy listening on {local_addr}") }) .build(); - ocsf_emit!(event); + egress_emit!(event); } // Detect the trusted host gateway IP from /etc/hosts before user code @@ -390,7 +398,7 @@ impl ProxyHandle { refusing to start: {err}" )) .build(); - ocsf_emit!(event); + egress_emit!(event); miette::miette!("invalid upstream corporate proxy configuration: {err}") })?, ); @@ -404,7 +412,7 @@ impl ProxyHandle { cfg.summary() )) .build(); - ocsf_emit!(event); + egress_emit!(event); } let (exited_tx, exited_rx) = tokio::sync::oneshot::channel::<()>(); @@ -574,7 +582,7 @@ impl ProxyHandle { ) .await { - ocsf_emit!(build_proxy_connection_error_event( + egress_emit!(build_proxy_connection_error_event( peer_addr, transparent_destination_addr, format!("Proxy connection error: {err}"), @@ -583,7 +591,7 @@ impl ProxyHandle { }); } Err(ProxyAcceptError::Source(err)) => { - ocsf_emit!(build_mediation_lane_failure_event(format!( + egress_emit!(build_mediation_lane_failure_event(format!( "Network-mediation source failed; proxy accept loop exiting: {err}" ))); break; @@ -594,7 +602,7 @@ impl ProxyHandle { &mut consecutive_resource_errors, &mut consecutive_unknown_errors, ); - ocsf_emit!(build_accept_error_event(local_addr, &err, &action)); + egress_emit!(build_accept_error_event(local_addr, &err, &action)); match action { AcceptAction::Terminal => break, AcceptAction::Retry { backoff, .. } => { @@ -946,7 +954,7 @@ fn emit_staged_transparent_denial( reason: &str, status_detail: &'static str, ) { - ocsf_emit!(build_staged_transparent_denial_event( + egress_emit!(build_staged_transparent_denial_event( destination, mapped_host, identity, @@ -1180,7 +1188,7 @@ impl TransparentTcpHandle { ) .await { - ocsf_emit!(build_connection_error_event( + egress_emit!(build_connection_error_event( peer_addr, format!("Transparent TCP connection error: {error}") )); @@ -1416,7 +1424,7 @@ async fn handle_transparent_tcp_connection( let pid = decision .binary_pid .map_or_else(|| "-".to_string(), |pid| pid.to_string()); - ocsf_emit!(build_transparent_tcp_allow_ocsf_event( + egress_emit!(build_transparent_tcp_allow_ocsf_event( TransparentTcpAllowAudit { workload: workload_addr, synthetic_destination: original, @@ -1560,7 +1568,7 @@ fn emit_transparent_mapping_denial( | MappingLookupError::InvalidMapping | MappingLookupError::LockPoisoned => "transparent_tcp_destination_denied", }; - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -1594,7 +1602,7 @@ fn emit_transparent_policy_denial( let pid = decision .binary_pid .map_or_else(|| "-".to_string(), |pid| pid.to_string()); - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -2066,6 +2074,61 @@ fn build_forward_allow_ocsf_event( .build() } +fn build_forward_rejection_event( + host: &str, + port: u16, + message: String, +) -> openshell_ocsf::OcsfEvent { + NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Fail) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) + .severity(SeverityId::Medium) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(host, port)) + .message(message) + .build() +} + +fn build_forward_l7_evaluation_error( + host: &str, + port: u16, + enforcement: crate::l7::EnforcementMode, + error: &str, +) -> openshell_ocsf::OcsfEvent { + let enforced = enforcement == crate::l7::EnforcementMode::Enforce; + NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Fail) + .action(if enforced { + ActionId::Denied + } else { + ActionId::Other + }) + .disposition(if enforced { + DispositionId::Blocked + } else { + DispositionId::Allowed + }) + .severity(SeverityId::Low) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(host, port)) + .message(format!("L7 evaluation failed: {error}")) + .build() +} + +fn emit_forward_l7_decision( + decision: openshell_ocsf::OcsfEvent, + evaluation_error: Option, + connect_span: &tracing::Span, +) { + // The HTTP decision carries policy context that its evaluation-error + // companion lacks, so it must supply the shared deny span's attributes. + crate::telemetry::emit_decision( + std::iter::once(decision).chain(evaluation_error), + Some(connect_span), + ); +} + fn build_forward_parse_error_ocsf_event( peer_addr: Option, method: &str, @@ -2080,6 +2143,8 @@ fn build_forward_parse_error_ocsf_event( .http_response(HttpResponse { code: StatusCode::BAD_REQUEST.as_u16(), }) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) .severity(SeverityId::Low) .status(StatusId::Failure) .message(format!("FORWARD parse error for {path}")); @@ -2324,7 +2389,7 @@ where C: TokioAsyncWrite + Unpin, { let detail = destination_denial_detail(denial.kind); - ocsf_emit!(build_connect_destination_deny_ocsf_event( + egress_emit!(build_connect_destination_deny_ocsf_event( denial, peer_addr, host, port, binary, pid, ancestors, cmdline, )); @@ -2357,6 +2422,7 @@ where #[allow(clippy::too_many_arguments)] async fn deny_forward_destination( client: &mut C, + connect_span: &tracing::Span, denial: &DestinationDenial, peer_addr: SocketAddr, method: &str, @@ -2376,9 +2442,12 @@ where C: TokioAsyncWrite + Unpin, { let detail = destination_denial_detail(denial.kind); - ocsf_emit!(build_forward_destination_deny_ocsf_event( - denial, peer_addr, method, host, port, path, binary, pid, ancestors, cmdline, policy, - )); + crate::telemetry::emit_decision( + [build_forward_destination_deny_ocsf_event( + denial, peer_addr, method, host, port, path, binary, pid, ancestors, cmdline, policy, + )], + Some(connect_span), + ); emit_denial_simple( denial_tx, @@ -2835,7 +2904,7 @@ async fn handle_mediated_connection( .message(format!("CONNECT denied {host_lc}:{port}")) .status_detail(&deny_reason) .build(); - ocsf_emit!(event); + egress_emit!(event); emit_denial( &denial_tx, &host_lc, @@ -3000,7 +3069,7 @@ async fn handle_mediated_connection( )) .status_detail(TLS_TERMINATION_UNAVAILABLE_DETAIL) .build(); - ocsf_emit!(event); + egress_emit!(event); emit_activity_simple(activity_tx.as_ref(), true, "tls_termination_unavailable"); emit_denial( &denial_tx, @@ -3038,7 +3107,7 @@ async fn handle_mediated_connection( )) .status_detail(DETAIL) .build(); - ocsf_emit!(event); + egress_emit!(event); crate::l7::emit_uninspected_credential_finding( &host_lc, policy_str, @@ -3120,7 +3189,7 @@ async fn handle_mediated_connection( // Log the allowed CONNECT — use CONNECT_L7 when L7 inspection follows, // so log consumers can distinguish L4-only decisions from tunnel lifecycle events. - ocsf_emit!(build_connect_allow_ocsf_event( + egress_emit!(build_connect_allow_ocsf_event( workload_addr, &host_lc, port, @@ -3231,7 +3300,7 @@ async fn handle_mediated_connection( .dst_endpoint(Endpoint::from_domain(&host_lc, port)) .message("Upstream TLS establishment failed") .build(); - ocsf_emit!(event); + egress_emit!(event); return Err(error); } }; @@ -3260,7 +3329,7 @@ async fn handle_mediated_connection( .dst_endpoint(Endpoint::from_domain(&host_lc, port)) .message(format!("TLS relay error: {e}")) .build(); - ocsf_emit!(event); + egress_emit!(event); } } } else { @@ -3292,7 +3361,7 @@ async fn handle_mediated_connection( .message(format!("CONNECT refused for {host_lc}:{port}: {DETAIL}")) .status_detail(DETAIL) .build(); - ocsf_emit!(event); + egress_emit!(event); emit_activity_simple(activity_tx.as_ref(), true, "tls_termination_unavailable"); emit_denial( &denial_tx, @@ -3335,7 +3404,7 @@ async fn handle_mediated_connection( .dst_endpoint(Endpoint::from_domain(&host_lc, port)) .message(message) .build(); - ocsf_emit!(event); + egress_emit!(event); } } } else { @@ -3365,7 +3434,7 @@ async fn handle_mediated_connection( )) .status_detail(protocol_detail) .build(); - ocsf_emit!(event); + egress_emit!(event); emit_activity_simple(activity_tx.as_ref(), true, "l7_parse_rejection"); emit_denial( &denial_tx, @@ -3966,7 +4035,7 @@ fn emit_l7_tunnel_close_after_policy_change(host: &str, port: u16, error: miette "L7 tunnel closed before inspection because policy changed: {error}" )) .build(); - ocsf_emit!(event); + egress_emit!(event); } async fn reject_stale_connect_policy( @@ -4808,7 +4877,7 @@ fn parse_allowed_ips(raw: &[String]) -> std::result::Result, S n.prefix_len() )) .build(); - ocsf_emit!(event); + egress_emit!(event); } nets.push(n); } @@ -5482,7 +5551,7 @@ async fn handle_forward_proxy( // canonicalized below before credential binding, policy-path evaluation, // upstream bytes, or telemetry consume it. let Ok((scheme, host, port, mut path)) = parse_proxy_uri(target_uri) else { - ocsf_emit!(build_forward_parse_error_ocsf_event( + egress_emit!(build_forward_parse_error_ocsf_event( workload_peer_addr, method, &telemetry_path @@ -5551,7 +5620,7 @@ async fn handle_forward_proxy( if scheme != "http" { let event = build_forward_unsupported_scheme_ocsf_event(method, &scheme, &host_lc, port); - ocsf_emit!(event); + egress_emit!(event); if scheme == "https" { respond( client, @@ -5643,18 +5712,21 @@ async fn handle_forward_proxy( let matched_policy = match &decision.action { NetworkAction::Allow { matched_policy } => matched_policy.clone(), NetworkAction::Deny { reason } => { - ocsf_emit!(build_forward_policy_deny_ocsf_event( - workload_addr, - method, - &host_lc, - port, - &telemetry_path, - &binary_str, - &pid_str, - &ancestors_str, - &cmdline_str, - reason, - )); + crate::telemetry::emit_decision( + [build_forward_policy_deny_ocsf_event( + workload_addr, + method, + &host_lc, + port, + &telemetry_path, + &binary_str, + &pid_str, + &ancestors_str, + &cmdline_str, + reason, + )], + Some(&connect_span), + ); emit_denial_simple( denial_tx, &host_lc, @@ -5754,16 +5826,12 @@ async fn handle_forward_proxy( let prepared_target = match prepare_forward_target(&path, canonicalize_options) { Ok(prepared) => prepared, Err(error) => { - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .severity(SeverityId::Medium) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(&host_lc, port)) - .message(format!( - "FORWARD rejecting non-canonical request-target: {error}" - )) - .build(); - ocsf_emit!(event); + let event = build_forward_rejection_event( + &host_lc, + port, + format!("FORWARD rejecting non-canonical request-target: {error}"), + ); + egress_emit!(event); emit_activity_simple(activity_tx, true, "forward_parse_rejection"); respond( client, @@ -5916,19 +5984,22 @@ async fn handle_forward_proxy( if !l7_config.config.allow_encoded_slash && crate::l7::path::canonical_path_has_encoded_slash(&path) { - ocsf_emit!(build_forward_l7_parse_rejection_ocsf_event( - workload_addr, - method, - &host_lc, - port, - &telemetry_path, - &binary_str, - &pid_str, - &ancestors_str, - &cmdline_str, - policy_str, - FORWARD_ENCODED_SLASH_REJECTION_DETAIL, - )); + crate::telemetry::emit_decision( + [build_forward_l7_parse_rejection_ocsf_event( + workload_addr, + method, + &host_lc, + port, + &telemetry_path, + &binary_str, + &pid_str, + &ancestors_str, + &cmdline_str, + policy_str, + FORWARD_ENCODED_SLASH_REJECTION_DETAIL, + )], + Some(&connect_span), + ); emit_activity_simple(activity_tx, true, "forward_parse_rejection"); respond( client, @@ -5973,7 +6044,7 @@ async fn handle_forward_proxy( )) .status_detail(upgrade_detail) .build(); - ocsf_emit!(event); + crate::telemetry::emit_decision([event], Some(&connect_span)); emit_activity_simple(activity_tx, true, "l7_parse_rejection"); emit_denial_simple( denial_tx, @@ -6031,14 +6102,12 @@ async fn handle_forward_proxy( { Ok(info) => info, Err(e) => { - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .severity(SeverityId::Medium) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(&host_lc, port)) - .message(format!("FORWARD_GRAPHQL_L7 request rejected: {e}")) - .build(); - ocsf_emit!(event); + let event = build_forward_rejection_event( + &host_lc, + port, + format!("FORWARD_GRAPHQL_L7 request rejected: {e}"), + ); + egress_emit!(event); emit_activity_simple(activity_tx, true, "l7_parse_rejection"); respond( client, @@ -6085,14 +6154,12 @@ async fn handle_forward_proxy( { Ok(body) => body, Err(e) => { - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .severity(SeverityId::Medium) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(&host_lc, port)) - .message(format!("FORWARD_JSONRPC_L7 request rejected: {e}")) - .build(); - ocsf_emit!(event); + let event = build_forward_rejection_event( + &host_lc, + port, + format!("FORWARD_JSONRPC_L7 request rejected: {e}"), + ); + egress_emit!(event); emit_activity_simple(activity_tx, true, "l7_parse_rejection"); respond( client, @@ -6143,18 +6210,17 @@ async fn handle_forward_proxy( let hard_deny_reason = crate::l7::relay::l7_request_hard_deny_reason(l7_config.config.protocol, &request_info); let force_deny = hard_deny_reason.is_some(); + let mut evaluation_error = None; let (allowed, reason) = hard_deny_reason.map_or_else( || { crate::l7::relay::evaluate_l7_request(&tunnel_engine, &l7_ctx, &request_info) .unwrap_or_else(|e| { - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .severity(SeverityId::Low) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(&host_lc, port)) - .message(format!("L7 eval failed, denying request: {e}")) - .build(); - ocsf_emit!(event); + evaluation_error = Some(build_forward_l7_evaluation_error( + &host_lc, + port, + l7_config.config.enforcement, + &e.to_string(), + )); (false, format!("L7 evaluation error: {e}")) }) }, @@ -6230,7 +6296,7 @@ async fn handle_forward_proxy( .firewall_rule(policy_str, engine_type) .message(log_message) .build(); - ocsf_emit!(event); + emit_forward_l7_decision(event, evaluation_error, &connect_span); } let effectively_denied = force_deny @@ -6281,6 +6347,7 @@ async fn handle_forward_proxy( Err(denial) => { deny_forward_destination( client, + &connect_span, &denial, workload_addr, method, @@ -6319,6 +6386,7 @@ async fn handle_forward_proxy( Err(denial) => { deny_forward_destination( client, + &connect_span, &denial, workload_addr, method, @@ -6428,7 +6496,12 @@ async fn handle_forward_proxy( exchange: &middleware_exchange, l7_reevaluation, }; - forward_request_bytes = match pipeline.apply(request, client).await? { + // Middleware denials join the connect trace, like other FORWARD denials. + forward_request_bytes = match pipeline + .apply(request, client) + .instrument(connect_span.clone()) + .await? + { crate::l7::middleware::MiddlewareApplyResult::Allowed(request) => request.raw_header, crate::l7::middleware::MiddlewareApplyResult::Denied { denial, .. } => { emit_activity_simple(activity_tx, true, "middleware"); @@ -6609,13 +6682,21 @@ async fn handle_forward_proxy( .await; } if e.is_placement_mismatch() { - crate::l7::relay::reject_credential_resolution(client, &l7_ctx, method, &e).await?; + crate::l7::relay::reject_credential_resolution(client, &l7_ctx, method, &e) + .instrument(connect_span.clone()) + .await?; client.shutdown().await.into_diagnostic()?; } else if e.is_endpoint_mismatch() { if let Some(observer) = endpoint_observer.as_ref() { observer.observe_credential_failure(true); } - emit_credential_endpoint_mismatch(method, &host_lc, port, policy_str); + emit_credential_endpoint_mismatch( + method, + &host_lc, + port, + policy_str, + &connect_span, + ); respond( client, &build_json_error_response( @@ -6742,7 +6823,7 @@ async fn handle_forward_proxy( "FORWARD upstream connect failed for {host_lc}:{port}: {e}" )) .build(); - ocsf_emit!(event); + egress_emit!(event); if let Some(session) = middleware_session.take() { session .end(openshell_core::proto::MiddlewareSessionEndReason::UpstreamFailure) @@ -6872,7 +6953,7 @@ async fn handle_forward_proxy( // The request has now survived middleware, token grant, credential // rewriting, generation checks, and the HTTP relay. Only now record the // final allowed outcome. - ocsf_emit!(build_forward_allow_ocsf_event( + egress_emit!(build_forward_allow_ocsf_event( workload_addr, method, &host_lc, diff --git a/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs b/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs index 010cb466c5..3623b1dbb7 100644 --- a/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs +++ b/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs @@ -116,6 +116,7 @@ async fn destination_denials_preserve_adapter_specific_wire_contracts() { let (mut app, mut proxy) = tcp_pair().await; deny_forward_destination( &mut proxy, + &tracing::Span::none(), &denial, peer, "POST", diff --git a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs new file mode 100644 index 0000000000..1602913885 --- /dev/null +++ b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs @@ -0,0 +1,246 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +use super::*; +use crate::telemetry::tests::{ + assert_deny_resolves, assert_no_deny, deny_spans, exported, span_attribute, +}; +use opentelemetry_proto::tonic::common::v1::any_value::Value; + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn paired_credential_denial_shares_one_deny_span() { + let (events, received) = exported("warn", || { + emit_credential_endpoint_mismatch( + "POST", + "blocked.example", + 443, + "credential-policy", + &tracing::Span::none(), + ); + }) + .await; + assert_eq!(events.len(), 2); + assert_eq!(received.spans.len(), 1); + assert_deny_resolves(&events, &received, true); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn repeated_credential_denials_keep_decision_spans_separate() { + for level in ["warn", "debug"] { + let (events, received) = exported(level, || { + let connect = + egress::connect_span(&EgressIntent::connect("blocked.example".to_string(), 443)); + // The FORWARD path passes its saved connect span without entering it. + for _ in 0..2 { + emit_credential_endpoint_mismatch( + "POST", + "blocked.example", + 443, + "credential-policy", + &connect, + ); + } + let allowed = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(ActionId::Allowed) + .dst_endpoint(Endpoint::from_domain("allowed.example", 443)) + .build(); + egress_emit!(allowed); + }) + .await; + + assert_eq!(events.len(), 5); + assert_deny_resolves(&events[..4], &received, level == "warn"); + assert!(events[4].get("trace").is_none(), "deny context must exit"); + let denies = deny_spans(&received); + assert_eq!(denies.len(), 2); + assert_ne!(denies[0].span_id, denies[1].span_id); + assert_eq!(received.spans.len(), if level == "debug" { 3 } else { 2 }); + if level == "debug" { + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + for deny in denies { + assert_eq!(deny.trace_id, connect.trace_id); + assert_eq!(deny.parent_span_id, connect.span_id); + } + assert_eq!(events[0]["trace"]["uid"], events[2]["trace"]["uid"]); + } else { + assert_ne!(events[0]["trace"]["uid"], events[2]["trace"]["uid"]); + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn network_class_forward_rejections_have_no_deny_trace() { + let (events, received) = exported("warn", || { + let Err(error) = + prepare_forward_target("/%zz", crate::l7::path::CanonicalizeOptions::default()) + else { + panic!("invalid escape must be rejected"); + }; + egress_emit!(build_forward_rejection_event( + "blocked.example", + 443, + format!("FORWARD rejecting non-canonical request-target: {error}") + )); + }) + .await; + assert_eq!(events.len(), 1); + assert_eq!(events[0]["action_id"], 2); + assert_no_deny(&events, &received); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn forward_denials_use_the_saved_connect_parent() { + for level in ["warn", "debug"] { + let (events, received) = crate::telemetry::tests::exported_over_otlp(level, || { + let intent = EgressIntent::connect("blocked.example".to_string(), 443); + let connect = egress::connect_span(&intent); + let decision = EgressDecision { + intent, + action: NetworkAction::Allow { + matched_policy: None, + }, + policy_generation: 1, + identity: ProcessIdentityEvidence::Available, + endpoint: EndpointDecision::default(), + binary: None, + binary_pid: None, + ancestors: vec![], + cmdline_paths: vec![], + }; + let denial = DestinationDenial { + kind: DestinationDenialKind::InternalAddress, + reason: "private destination".to_string(), + }; + let mut output = Vec::new(); + futures::executor::block_on(deny_forward_destination( + &mut output, + &connect, + &denial, + "127.0.0.1:41000".parse().unwrap(), + "POST", + "blocked.example", + 443, + "/", + "curl", + "42", + "-", + "curl", + "forward-policy", + &decision, + None, + None, + )) + .unwrap(); + assert!(output.starts_with(b"HTTP/1.1 403 Forbidden")); + }) + .await; + assert_eq!(events.len(), 1); + assert_deny_resolves(&events, &received, level == "warn"); + let denies = deny_spans(&received); + assert_eq!(denies.len(), 1); + if level == "debug" { + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + let deny = denies[0]; + assert_eq!(deny.parent_span_id, connect.span_id); + assert_eq!(events[0]["trace"]["uid"], hex::encode(&connect.trace_id)); + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn forward_evaluation_error_keeps_the_http_decision_policy_context() { + for level in ["warn", "debug"] { + for mode in [ + crate::l7::EnforcementMode::Audit, + crate::l7::EnforcementMode::Enforce, + ] { + let enforced = mode == crate::l7::EnforcementMode::Enforce; + let (events, received) = exported(level, || { + let connect = egress::connect_span(&EgressIntent::forward_http( + "blocked.example".to_string(), + 443, + )); + let decision = HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Other) + .action(if enforced { + ActionId::Denied + } else { + ActionId::Allowed + }) + .disposition(if enforced { + DispositionId::Blocked + } else { + DispositionId::Allowed + }) + .http_request(HttpRequest::new( + "GET", + OcsfUrl::new("http", "blocked.example", "/", 443), + )) + .dst_endpoint(Endpoint::from_domain("blocked.example", 443)) + .firewall_rule("forward-policy", "l7") + .build(); + let error = build_forward_l7_evaluation_error( + "blocked.example", + 443, + mode, + "evaluation unavailable", + ); + // Use the same grouping as the forward-proxy production path. + emit_forward_l7_decision(decision, Some(error), &connect); + }) + .await; + + assert_eq!(events.len(), 2); + let http_decision = events + .iter() + .find(|event| event["class_uid"] == 4002) + .unwrap(); + let evaluation_error = events + .iter() + .find(|event| event["class_uid"] == 4001) + .unwrap(); + let denies = deny_spans(&received); + if enforced { + assert_eq!(denies.len(), 1); + assert_eq!(received.spans.len(), if level == "debug" { 2 } else { 1 }); + assert_eq!(http_decision["action_id"], 2); + assert_eq!(evaluation_error["action_id"], 2); + assert_deny_resolves(&events, &received, level == "warn"); + let attribute = |key: &str| span_attribute(denies[0], key); + assert_eq!( + attribute("openshell.policy.name"), + Some(&Value::StringValue("forward-policy".to_string())), + "the shared deny span must retain the HTTP decision's policy name" + ); + assert_eq!( + attribute("server.address"), + Some(&Value::StringValue("blocked.example".to_string())) + ); + assert_eq!(attribute("ocsf.class_uid"), Some(&Value::IntValue(4002))); + // This production decision currently has no status_detail. + assert!(attribute("openshell.policy.reason").is_none()); + if level == "debug" { + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + assert_eq!(denies[0].parent_span_id, connect.span_id); + assert_eq!(denies[0].trace_id, connect.trace_id); + } + } else { + assert_eq!(http_decision["action_id"], 1); + assert_eq!(evaluation_error["action_id"], 99); + assert_no_deny(&events, &received); + } + } + } +} diff --git a/crates/openshell-supervisor-network/src/run.rs b/crates/openshell-supervisor-network/src/run.rs index 9f8ce690f0..0c342c6bab 100644 --- a/crates/openshell-supervisor-network/src/run.rs +++ b/crates/openshell-supervisor-network/src/run.rs @@ -22,7 +22,7 @@ use openshell_core::policy::{NetworkMode, SandboxPolicy}; use openshell_core::proto::SandboxPolicy as ProtoSandboxPolicy; use openshell_core::provider_credentials::ProviderCredentialState; use openshell_ocsf::{ - ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ctx::ctx as ocsf_ctx, ocsf_emit, + ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ctx::ctx as ocsf_ctx, }; use openshell_core::activity::ActivitySender; @@ -491,7 +491,7 @@ pub async fn run_networking( let upstream_config = build_upstream_client_config(&system_ca_bundle)?; let cert_cache = CertCache::new(ca); let state = Arc::new(ProxyTlsState::new(cert_cache, upstream_config)); - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -510,7 +510,7 @@ pub async fn run_networking( // cannot rewrite credentials, so it fails closed on // TLS-bearing connections (see proxy.rs) rather than // leaking placeholders through a raw tunnel. - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) @@ -529,7 +529,7 @@ pub async fn run_networking( // rewrite credentials, so it fails closed on TLS-bearing // connections (see proxy.rs) rather than leaking placeholders // through a raw tunnel. - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) diff --git a/crates/openshell-supervisor-network/src/telemetry.rs b/crates/openshell-supervisor-network/src/telemetry.rs new file mode 100644 index 0000000000..73e573b985 --- /dev/null +++ b/crates/openshell-supervisor-network/src/telemetry.rs @@ -0,0 +1,222 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +//! Keep a deny span active during OCSF emission. + +use std::collections::HashMap; +use std::sync::{LazyLock, Mutex}; +use std::time::{Duration, Instant}; + +use openshell_ocsf::{ActionId, HttpActivityEvent, OcsfEvent}; + +/// Emit one egress event, entering an INFO deny span if it is denied HTTP Activity. +macro_rules! egress_emit { + ($event:expr) => { + $crate::telemetry::emit_decision([$event], None) + }; +} +pub(crate) use egress_emit; + +fn is_denied(event: &OcsfEvent) -> bool { + match event { + OcsfEvent::NetworkActivity(event) => event.action == Some(ActionId::Denied), + OcsfEvent::HttpActivity(event) => event.action == Some(ActionId::Denied), + OcsfEvent::DetectionFinding(event) => event.action == Some(ActionId::Denied), + _ => false, + } +} + +fn as_http(event: &OcsfEvent) -> Option<&HttpActivityEvent> { + match event { + OcsfEvent::HttpActivity(event) => Some(event), + _ => None, + } +} + +/// Emit all records of one synchronous decision under one deny span. Only HTTP +/// Activity carries `trace`, so only a denied decision with an HTTP record gets +/// a span. The span describes the denied HTTP record, or the first HTTP record +/// when only a companion finding is denied. A saved `parent` keeps the span in +/// the connect trace after authorization exits. +#[allow(clippy::disallowed_macros)] +pub fn emit_decision(events: impl IntoIterator, parent: Option<&tracing::Span>) { + let events: Vec<_> = events.into_iter().collect(); + let span = if events.iter().any(is_denied) { + events + .iter() + .filter(|event| is_denied(event)) + .find_map(as_http) + .or_else(|| events.iter().find_map(as_http)) + .and_then(|event| deny_span(event, parent)) + } else { + None + }; + let emit = || { + for event in events { + openshell_ocsf::ocsf_emit!(event); + } + }; + if let Some(span) = span { + span.in_scope(emit); + } else { + emit(); + } +} + +/// Returns `None` when deny spans are disabled or the destination has used up +/// its deny spans. Disabled spans spend no tokens. +fn deny_span(event: &HttpActivityEvent, parent: Option<&tracing::Span>) -> Option { + if !tracing::enabled!(kind: tracing::metadata::Kind::SPAN, tracing::Level::INFO) { + return None; + } + let endpoint = event.dst_endpoint.as_ref(); + let address = + endpoint.and_then(|endpoint| endpoint.domain.as_deref().or(endpoint.ip.as_deref())); + let port = endpoint.and_then(|endpoint| endpoint.port); + let destination = format!( + "{}:{}", + address.unwrap_or_default(), + port.unwrap_or_default() + ); + if !LIMITER + .lock() + .unwrap_or_else(std::sync::PoisonError::into_inner) + .allow(&destination, Instant::now()) + { + return None; + } + let parent = parent.cloned().unwrap_or_else(tracing::Span::current); + Some(tracing::info_span!( + parent: &parent, + "supervisor.egress.deny", + openshell.policy.decision = "deny", + openshell.policy.name = event.firewall_rule.as_ref().map(|rule| rule.name.as_str()), + openshell.policy.reason = event.base.status_detail.as_deref(), + server.address = address, + server.port = port.map(i64::from), + ocsf.class_uid = i64::from(event.base.class_uid), + )) +} + +/// Deny spans one destination can export at once; one more is allowed per +/// second after that. +const DENY_SPAN_BURST: u32 = 10; +const DENY_SPAN_REFILL: Duration = Duration::from_secs(1); +const DENY_SPAN_DESTINATIONS: usize = 1024; +/// Bound aggregate span creation even when a workload rotates destinations. +const DENY_SPAN_GLOBAL_BURST: u32 = 100; +const DENY_SPAN_GLOBAL_REFILL: Duration = Duration::from_millis(10); + +static LIMITER: LazyLock> = LazyLock::new(|| Mutex::new(default_limiter())); + +fn default_limiter() -> DenySpanLimiter { + DenySpanLimiter::new(DENY_SPAN_BURST, DENY_SPAN_REFILL, DENY_SPAN_DESTINATIONS) +} + +#[cfg(test)] +fn reset_deny_span_limiter() { + *LIMITER + .lock() + .unwrap_or_else(std::sync::PoisonError::into_inner) = default_limiter(); +} + +/// Per-destination and process-wide token buckets bounding deny-span work. +/// OCSF records are unaffected; a limited decision creates no additional span. +struct DenySpanLimiter { + burst: u32, + refill: Duration, + capacity: usize, + buckets: HashMap, + global_burst: u32, + global_refill: Duration, + global: Option, +} + +struct Bucket { + tokens: u32, + refilled: Instant, +} + +impl DenySpanLimiter { + fn new(burst: u32, refill: Duration, capacity: usize) -> Self { + Self::with_global_limit( + burst, + refill, + capacity, + DENY_SPAN_GLOBAL_BURST, + DENY_SPAN_GLOBAL_REFILL, + ) + } + + fn with_global_limit( + burst: u32, + refill: Duration, + capacity: usize, + global_burst: u32, + global_refill: Duration, + ) -> Self { + Self { + burst, + refill, + capacity, + buckets: HashMap::new(), + global_burst, + global_refill, + global: None, + } + } + + fn allow(&mut self, destination: &str, now: Instant) -> bool { + let global = self.global.get_or_insert(Bucket { + tokens: self.global_burst, + refilled: now, + }); + global.refill(self.global_burst, self.global_refill, now); + if global.tokens == 0 { + return false; + } + if !self.buckets.contains_key(destination) && self.buckets.len() >= self.capacity { + for bucket in self.buckets.values_mut() { + bucket.refill(self.burst, self.refill, now); + } + let burst = self.burst; + self.buckets.retain(|_, bucket| bucket.tokens < burst); + if self.buckets.len() >= self.capacity { + return false; + } + } + let bucket = self + .buckets + .entry(destination.to_string()) + .or_insert(Bucket { + tokens: self.burst, + refilled: now, + }); + bucket.refill(self.burst, self.refill, now); + let allowed = bucket.tokens > 0; + if allowed { + bucket.tokens -= 1; + global.tokens -= 1; + } + allowed + } +} + +impl Bucket { + fn refill(&mut self, burst: u32, interval: Duration, now: Instant) { + let earned = now.saturating_duration_since(self.refilled).as_nanos() / interval.as_nanos(); + if earned == 0 { + return; + } + let earned = u32::try_from(earned).unwrap_or(u32::MAX); + self.tokens = self.tokens.saturating_add(earned).min(burst); + self.refilled = if self.tokens == burst { + now + } else { + self.refilled + interval * earned + }; + } +} + +#[cfg(test)] +pub mod tests; diff --git a/crates/openshell-supervisor-network/src/telemetry/tests.rs b/crates/openshell-supervisor-network/src/telemetry/tests.rs new file mode 100644 index 0000000000..7a3388ad0d --- /dev/null +++ b/crates/openshell-supervisor-network/src/telemetry/tests.rs @@ -0,0 +1,602 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +use std::sync::{Arc, LazyLock, Mutex}; + +use openshell_otel_test_support::{OtlpTestServer, ReceivedTraces, tracing_test_lock}; +use opentelemetry_proto::tonic::common::v1::any_value::Value; +use opentelemetry_proto::tonic::trace::v1::Span; +use tracing_subscriber::prelude::*; + +#[derive(Clone)] +struct Writer(Arc>>); +impl std::io::Write for Writer { + fn write(&mut self, bytes: &[u8]) -> std::io::Result { + self.0.lock().unwrap().extend_from_slice(bytes); + Ok(bytes.len()) + } + fn flush(&mut self) -> std::io::Result<()> { + Ok(()) + } +} + +/// Capture the actual OCSF dispatch and the spans an in-memory exporter +/// receives through the supervisor's span filter. +pub async fn exported( + log_level: &str, + emit: impl FnOnce(), +) -> (Vec, ReceivedTraces) { + let _lock = tracing_test_lock().await; + LazyLock::force(®ISTER); + super::reset_deny_span_limiter(); + let exporter = opentelemetry_sdk::trace::InMemorySpanExporter::default(); + let provider = opentelemetry_sdk::trace::SdkTracerProvider::builder() + .with_simple_exporter(exporter.clone()) + .build(); + let events = capture(log_level, &provider, emit); + provider.force_flush().unwrap(); + let spans = exporter + .get_finished_spans() + .unwrap() + .into_iter() + .map(Into::into) + .collect(); + provider.shutdown().unwrap(); + ( + events, + ReceivedTraces { + spans, + ..ReceivedTraces::default() + }, + ) +} + +/// Capture the actual OCSF dispatch and receive spans over OTLP/gRPC. +pub async fn exported_over_otlp( + log_level: &str, + emit: impl FnOnce(), +) -> (Vec, ReceivedTraces) { + let _lock = tracing_test_lock().await; + LazyLock::force(®ISTER); + super::reset_deny_span_limiter(); + let collector = OtlpTestServer::start().await; + let (provider, error) = openshell_otel::provider_for(Some(openshell_otel::OtlpExportConfig { + endpoint: collector.endpoint(), + service_name: openshell_otel::ServiceName::Fixed("openshell-supervisor"), + service_version: None, + resource_attributes: vec![], + })); + assert!(error.is_none()); + let provider = provider.unwrap(); + let events = capture(log_level, &provider, emit); + provider.force_flush().unwrap(); + collector.wait_for_export().await; + provider.shutdown().unwrap(); + (events, collector.shutdown().await) +} + +static REGISTER: LazyLock<()> = LazyLock::new(|| { + assert!(openshell_ocsf::register_trace_correlation_extractor( + openshell_otel::current_ocsf_trace_correlation + )); +}); + +fn capture( + log_level: &str, + provider: &opentelemetry_sdk::trace::SdkTracerProvider, + emit: impl FnOnce(), +) -> Vec { + let bytes = Arc::new(Mutex::new(vec![])); + let subscriber = tracing_subscriber::registry() + .with( + openshell_ocsf::OcsfJsonlLayer::new(Writer(bytes.clone())) + .with_filter(tracing_subscriber::filter::LevelFilter::INFO), + ) + .with( + openshell_otel::layer(provider, "openshell-supervisor") + .with_filter(openshell_otel::supervisor_span_filter(log_level)), + ) + // The shared test registry keeps callsites enabled process-wide. + // Gate this subscriber too, so the default case also checks a disabled + // DEBUG connect handle, as well as absence from the OTLP export. + .with(openshell_otel::supervisor_span_filter(log_level)); + tracing::subscriber::with_default(subscriber, emit); + String::from_utf8(bytes.lock().unwrap().clone()) + .unwrap() + .lines() + .map(|line| serde_json::from_str(line).unwrap()) + .collect() +} + +pub fn assert_deny_resolves(events: &[serde_json::Value], received: &ReceivedTraces, root: bool) { + assert!(events.iter().any(|event| event["class_uid"] == 4002)); + for event in events { + if event["class_uid"] != 4002 { + assert!( + event.get("trace").is_none(), + "only HTTP Activity carries trace" + ); + continue; + } + let uid = event["trace"]["uid"] + .as_str() + .expect("emission was inside sampled deny span"); + assert_eq!(uid.len(), 32); + assert!( + event["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|p| p == "trace") + ); + let span = deny_spans(received) + .into_iter() + .find(|span| hex::encode(&span.trace_id) == uid) + .expect("OCSF trace.uid resolves to exported deny span"); + if root { + assert!(span.parent_span_id.is_empty()); + assert_eq!( + received + .spans + .iter() + .filter(|other| other.trace_id == span.trace_id) + .count(), + 1 + ); + } + let attributes = span + .attributes + .iter() + .map(|kv| kv.key.as_str()) + .collect::>(); + for key in ["openshell.policy.decision", "ocsf.class_uid"] { + assert!(attributes.contains(&key), "deny span carries {key}"); + } + let class_uid = span_attribute(span, "ocsf.class_uid"); + assert!( + matches!(class_uid, Some(Value::IntValue(_))), + "deny span exports ocsf.class_uid as an integer: {class_uid:?}" + ); + } +} + +pub fn http_deny(host: &str, decision: &str) -> openshell_ocsf::OcsfEvent { + openshell_ocsf::HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .http_request(openshell_ocsf::HttpRequest::new( + "GET", + openshell_ocsf::Url::new("https", host, "/", 443), + )) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain(host, 443)) + .status_detail(decision) + .message(decision) + .build() +} + +pub fn deny_spans(received: &ReceivedTraces) -> Vec<&Span> { + received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .collect() +} + +/// Assert that no record carries `trace` and no deny span was exported. +pub fn assert_no_deny(events: &[serde_json::Value], received: &ReceivedTraces) { + for event in events { + assert!(event.get("trace").is_none(), "{event}"); + } + assert!(deny_spans(received).is_empty()); +} + +pub fn span_attribute<'a>(span: &'a Span, key: &str) -> Option<&'a Value> { + span.attributes + .iter() + .find(|attribute| attribute.key == key) + .and_then(|attribute| attribute.value.as_ref()?.value.as_ref()) +} + +pub fn assert_deny_attribute(received: &ReceivedTraces, key: &str, expected: &str) { + assert_eq!( + span_attribute(deny_spans(received)[0], key), + Some(&Value::StringValue(expected.to_string())) + ); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn companion_records_share_one_deny_span() { + let (events, received) = exported("warn", || { + let event = http_deny("blocked.example", "denied"); + let finding = + openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()).build(); + super::emit_decision([event, finding], None); + }) + .await; + assert_eq!(events.len(), 2); + assert_eq!(received.spans.len(), 1); + assert_deny_resolves(&events, &received, true); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { + for level in ["warn", "debug"] { + let (events, received) = exported(level, || { + let dispatch = tracing::dispatcher::get_default(Clone::clone); + let barrier = std::sync::Barrier::new(2); + std::thread::scope(|threads| { + for host in ["alpha.example", "beta.example"] { + let dispatch = &dispatch; + let barrier = &barrier; + threads.spawn(move || { + tracing::dispatcher::with_default(dispatch, || { + let outside = openshell_ocsf::ctx::ctx().sandbox_id.clone(); + let mut context = (*openshell_ocsf::ctx::ctx()).clone(); + context.sandbox_id = host.to_string(); + context.sandbox_name = format!("sandbox-{host}"); + openshell_ocsf::ctx::bind_thread_ctx(Some(Arc::new(context))); + let connect = tracing::debug_span!("supervisor.egress.connect"); + connect.in_scope(|| { + for attempt in 0..2 { + let decision = format!("{host}:{attempt}"); + let event = http_deny(host, &decision); + let finding = openshell_ocsf::DetectionFindingBuilder::new( + openshell_ocsf::ctx::ctx(), + ) + .message(&decision) + .build(); + super::emit_decision([event, finding], None); + // Both threads finish each decision before either + // starts the next. + barrier.wait(); + } + }); + openshell_ocsf::ctx::bind_thread_ctx(None); + assert_eq!(openshell_ocsf::ctx::ctx().sandbox_id, outside); + }); + }); + } + }); + }) + .await; + + assert_eq!(events.len(), 8); + assert_deny_resolves(&events, &received, level == "warn"); + let denies = deny_spans(&received); + assert_eq!(denies.len(), 4); + assert_eq!(received.spans.len(), if level == "debug" { 6 } else { 4 }); + let attribute = |span: &Span, key: &str| match span_attribute(span, key) { + Some(Value::StringValue(value)) => value.clone(), + other => panic!("expected string attribute {key}, got {other:?}"), + }; + let mut traces_by_host = Vec::new(); + for host in ["alpha.example", "beta.example"] { + let mut traces = Vec::new(); + for attempt in 0..2 { + let decision = format!("{host}:{attempt}"); + let pair = events + .iter() + .filter(|event| event["message"] == decision) + .collect::>(); + assert_eq!(pair.len(), 2); + for event in &pair { + assert_eq!(event["device"]["container"]["uid"], host); + assert_eq!( + event["device"]["container"]["name"], + format!("sandbox-{host}") + ); + } + let http = pair + .iter() + .find(|event| event["class_uid"] == 4002) + .unwrap(); + let spans = denies + .iter() + .filter(|span| attribute(span, "openshell.policy.reason") == decision) + .collect::>(); + assert_eq!(spans.len(), 1); + let deny = spans[0]; + assert_eq!(attribute(deny, "server.address"), host); + assert_eq!(http["trace"]["uid"], hex::encode(&deny.trace_id)); + if level == "debug" { + let connect = received + .spans + .iter() + .find(|span| span.span_id == deny.parent_span_id) + .unwrap(); + assert_eq!(connect.name, "supervisor.egress.connect"); + assert_eq!(connect.trace_id, deny.trace_id); + } + traces.push(deny.trace_id.clone()); + } + if level == "debug" { + assert_eq!(traces[0], traces[1]); + } else { + assert_ne!(traces[0], traces[1]); + } + traces_by_host.push(traces); + } + for alpha in &traces_by_host[0] { + for beta in &traces_by_host[1] { + assert_ne!( + alpha, beta, + "independent request contexts must stay separate" + ); + } + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn deny_span_describes_the_denied_http_record() { + let (events, received) = exported("warn", || { + let allowed = openshell_ocsf::HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Allowed) + .http_request(openshell_ocsf::HttpRequest::new( + "GET", + openshell_ocsf::Url::new("https", "allowed.example", "/", 443), + )) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain( + "allowed.example", + 443, + )) + .build(); + super::emit_decision([allowed, http_deny("blocked.example", "denied")], None); + }) + .await; + assert_deny_resolves(&events, &received, true); + assert_deny_attribute(&received, "server.address", "blocked.example"); + assert_deny_attribute(&received, "openshell.policy.reason", "denied"); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn missing_deny_context_leaves_optional_attributes_unset() { + let (events, received) = exported("warn", || { + let http = openshell_ocsf::HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .http_request(openshell_ocsf::HttpRequest { + http_method: "GET".parse().unwrap(), + url: None, + }) + .message("diagnostic text is not a policy reason") + .build(); + super::egress_emit!(http); + }) + .await; + assert_deny_resolves(&events, &received, true); + assert_eq!(events.len(), 1); + assert_eq!(received.spans.len(), 1); + for span in &received.spans { + for key in [ + "openshell.policy.name", + "openshell.policy.reason", + "server.address", + "server.port", + ] { + assert!( + span.attributes.iter().all(|kv| kv.key != key), + "{key} stays unset" + ); + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn denials_without_an_http_record_do_not_open_deny_spans() { + let (events, received) = exported("warn", || { + let network = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain( + "blocked.example", + 443, + )) + .build(); + let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .build(); + super::emit_decision([network, finding], None); + }) + .await; + assert_eq!(events.len(), 2); + assert_no_deny(&events, &received); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn allowed_emissions_do_not_create_info_deny_spans() { + let (events, received) = exported("warn", || { + let allowed = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Allowed) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain( + "allowed.example", + 443, + )) + .build(); + super::egress_emit!(allowed); + crate::l7::middleware::emit_middleware_uninspectable( + &crate::l7::relay::L7EvalContext::default(), + "unknown protocol", + false, + ); + }) + .await; + assert_eq!(events.len(), 2); + assert_no_deny(&events, &received); +} + +#[test] +fn deny_span_limiter_bounds_each_destination_and_refills() { + use std::time::{Duration, Instant}; + + let start = Instant::now(); + let mut limiter = super::DenySpanLimiter::new(2, Duration::from_secs(1), 8); + assert!(limiter.allow("a:443", start)); + assert!(limiter.allow("a:443", start)); + assert!(!limiter.allow("a:443", start)); + assert!( + limiter.allow("b:443", start), + "destinations are independent" + ); + assert!(!limiter.allow("a:443", start + Duration::from_millis(999))); + assert!(limiter.allow("a:443", start + Duration::from_secs(1))); + assert!(!limiter.allow("a:443", start + Duration::from_secs(1))); + let later = start + Duration::from_mins(1); + assert!(limiter.allow("a:443", later)); + assert!(limiter.allow("a:443", later)); + assert!(!limiter.allow("a:443", later), "refill stops at the burst"); +} + +#[test] +fn deny_span_limiter_bounds_tracked_destinations() { + use std::time::{Duration, Instant}; + + let start = Instant::now(); + let mut limiter = super::DenySpanLimiter::new(1, Duration::from_secs(1), 2); + assert!(limiter.allow("a", start)); + assert!(limiter.allow("b", start)); + assert!( + !limiter.allow("c", start), + "untracked destinations wait for room" + ); + // Full buckets are idle and can be evicted. + assert!(limiter.allow("c", start + Duration::from_secs(1))); +} + +#[test] +fn deny_span_limiter_bounds_aggregate_bursts_and_refills() { + use std::time::{Duration, Instant}; + + let start = Instant::now(); + let mut limiter = super::DenySpanLimiter::with_global_limit( + 1, + Duration::from_secs(1), + 8, + 2, + Duration::from_millis(100), + ); + assert!(limiter.allow("a", start)); + assert!( + !limiter.allow("a", start), + "a destination rejection spends no global token" + ); + assert!(limiter.allow("b", start)); + assert!( + !limiter.allow("c", start), + "rotating destinations cannot exceed the global burst" + ); + assert!(!limiter.allow("c", start + Duration::from_millis(99))); + assert!(limiter.allow("c", start + Duration::from_millis(100))); + assert!(!limiter.allow("d", start + Duration::from_millis(100))); + let later = start + Duration::from_secs(10); + assert!(limiter.allow("a", later)); + assert!(limiter.allow("b", later)); + assert!( + !limiter.allow("c", later), + "global refill stops at its burst" + ); +} + +#[test] +fn destination_capacity_rejections_spend_no_global_tokens() { + use std::time::{Duration, Instant}; + + let start = Instant::now(); + let mut limiter = super::DenySpanLimiter::with_global_limit( + 10, + Duration::from_secs(1), + 1, + 2, + Duration::from_secs(1), + ); + assert!(limiter.allow("a", start)); + assert!(!limiter.allow("b", start)); + assert!(limiter.allow("a", start)); + assert!(!limiter.allow("a", start)); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn aggregate_deny_limit_preserves_every_audit_record() { + let (events, received) = exported("warn", || { + *super::LIMITER.lock().unwrap() = super::DenySpanLimiter::with_global_limit( + 10, + std::time::Duration::from_secs(1), + 1024, + 3, + std::time::Duration::MAX, + ); + for index in 0..12 { + super::egress_emit!(http_deny(&format!("host-{index}.example"), "denied")); + } + }) + .await; + assert_eq!( + events.len(), + 12, + "the span budget never suppresses audit records" + ); + assert!(events.iter().all(|event| event["action_id"] == 2)); + assert_eq!(deny_spans(&received).len(), 3); + assert_eq!( + events + .iter() + .filter(|event| event.get("trace").is_some()) + .count(), + 3 + ); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn limited_denial_keeps_an_active_sampled_connect_trace() { + let (events, received) = exported("debug", || { + *super::LIMITER.lock().unwrap() = super::DenySpanLimiter::with_global_limit( + 1, + std::time::Duration::MAX, + 1024, + 100, + std::time::Duration::MAX, + ); + tracing::debug_span!("supervisor.egress.connect").in_scope(|| { + super::egress_emit!(http_deny("blocked.example", "first")); + super::egress_emit!(http_deny("blocked.example", "limited")); + }); + }) + .await; + assert_eq!(events.len(), 2); + assert_eq!(deny_spans(&received).len(), 1); + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + assert_eq!(events[1]["trace"]["uid"], hex::encode(&connect.trace_id)); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn repeated_denials_to_one_destination_export_bounded_spans() { + let (events, received) = exported("warn", || { + for _ in 0..(super::DENY_SPAN_BURST + 5) { + super::egress_emit!(http_deny("loop.example", "denied")); + } + super::egress_emit!(http_deny("other.example", "denied")); + }) + .await; + let denies = deny_spans(&received).len(); + assert_eq!(denies, super::DENY_SPAN_BURST as usize + 1); + let traced = events + .iter() + .filter(|event| event.get("trace").is_some()) + .count(); + assert_eq!(traced, denies, "limited records carry no trace.uid"); + assert_eq!(events.len(), super::DENY_SPAN_BURST as usize + 6); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn disabled_deny_spans_spend_no_tokens() { + let _lock = tracing_test_lock().await; + super::reset_deny_span_limiter(); + let subscriber = + tracing_subscriber::registry().with(tracing_subscriber::filter::LevelFilter::WARN); + tracing::subscriber::with_default(subscriber, || { + super::egress_emit!(http_deny("quiet.example", "denied")); + }); + assert!(super::LIMITER.lock().unwrap().buckets.is_empty()); + assert!(super::LIMITER.lock().unwrap().global.is_none()); +} diff --git a/crates/openshell-supervisor/src/main.rs b/crates/openshell-supervisor/src/main.rs index feb3aea9c8..4c1bcac7a0 100644 --- a/crates/openshell-supervisor/src/main.rs +++ b/crates/openshell-supervisor/src/main.rs @@ -18,7 +18,6 @@ use openshell_core::sandbox_env::OtlpProtocol; use openshell_isolation_interface::contract::BackendDescriptor; use tracing::{error, info, warn}; use tracing_subscriber::EnvFilter; -use tracing_subscriber::filter::LevelFilter; use tracing_subscriber::{Layer as _, layer::SubscriberExt as _, util::SubscriberInitExt as _}; mod logging; @@ -455,6 +454,10 @@ fn main() -> Result<()> { return openshell_supervisor::check_control_readiness(&args.socket); } + openshell_ocsf::register_trace_correlation_extractor( + openshell_otel::current_ocsf_trace_correlation, + ); + let args = Args::parse(); if args.mode == SupervisorMode::Shared { return shared::run(args); @@ -563,7 +566,7 @@ fn main() -> Result<()> { otlp_layer_provider .as_ref() .map(|provider| openshell_otel::layer(provider, SERVICE_NAME)) - .with_filter(otlp_span_filter(&args.log_level)), + .with_filter(openshell_otel::supervisor_span_filter(&args.log_level)), ) .init(); if !file_available { @@ -845,16 +848,6 @@ fn supervisor_resource_attributes( .collect() } -/// A more verbose log level raises `openshell*` spans; dependency spans stay at -/// INFO so they do not flood the exporter queue. -fn otlp_span_filter(log_level: &str) -> EnvFilter { - let level = log_level - .parse::() - .unwrap_or(LevelFilter::INFO) - .max(LevelFilter::INFO); - EnvFilter::new(format!("info,openshell={level}")) -} - /// Choose the supervisor's exit status for a sandbox run. /// /// The reserved status tells the compute driver that the sandbox rejected the @@ -957,15 +950,6 @@ mod tests { use super::*; - #[test] - fn otlp_span_filter_raises_only_openshell_targets() { - let directives = |log_level: &str| otlp_span_filter(log_level).to_string(); - assert_eq!(directives("warn"), "openshell=info,info"); - assert_eq!(directives("info"), "openshell=info,info"); - assert_eq!(directives("debug"), "openshell=debug,info"); - assert_eq!(directives("info,h2=debug"), "openshell=info,info"); - } - #[test] fn only_workspace_validation_failure_exits_with_reserved_status() { use miette::WrapErr as _; diff --git a/docs/how-it-works/gateways/configuration.mdx b/docs/how-it-works/gateways/configuration.mdx index 175836ccb4..424efa6016 100644 --- a/docs/how-it-works/gateways/configuration.mdx +++ b/docs/how-it-works/gateways/configuration.mdx @@ -810,6 +810,7 @@ Each OCSF event becomes one log record: | Timestamp | The OCSF `time`. The observed timestamp is when the gateway received the event. | | Severity | Unknown, Informational, and Other are INFO, Low is WARN, Medium is WARN2, High is ERROR, Critical is ERROR2, and Fatal is FATAL. The severity text is the OCSF severity name. | | Attributes | `ocsf.class_uid`, `ocsf.activity_id`, `ocsf.severity_id`, `ocsf.metadata.uid`, and, for events associated with a sandbox, `openshell.sandbox.id`. | +| Trace context | The trace and span ID of the sampled span active when the event was emitted, for every OCSF class. Absent when no sampled span was active. | `schema_version` in this table is deprecated and ignored; the gateway logs a warning at startup when it is set. diff --git a/docs/observability/ocsf-json-export.mdx b/docs/observability/ocsf-json-export.mdx index e5cc5e363b..2f4b52c10f 100644 --- a/docs/observability/ocsf-json-export.mdx +++ b/docs/observability/ocsf-json-export.mdx @@ -286,6 +286,37 @@ And a denied connection, produced when `curl https://github.com` runs in a sandb The JSON examples above are formatted for readability. The actual JSONL file contains one JSON object per line with no whitespace formatting. +## Refusal Records + +Every record that describes a refusal sets `action` to `Denied`. On Network and HTTP Activity, `disposition` is `Blocked`, except for FORWARD requests with an unsupported scheme, which report `Rejected`. Besides policy denials, this includes: + +- FORWARD requests the proxy rejects as unparsable, non-canonical, or invalid GraphQL or JSON-RPC. +- L7 evaluation errors under `enforcement: enforce`. Under `enforcement: audit` they report `action` Other and `disposition` Allowed, because the request proceeds. +- Google Cloud metadata server emulation responses with status 403 or 405. +- Fail-closed request, response, and WebSocket middleware, including the HTTP Activity record for a fail-closed response stage and the Detection Findings for a fail-closed stage or chain or a failed post-middleware policy evaluation. +- Response delivery the supervisor refuses because middleware stopped it, its preflight failed, or the upstream response head could not be normalized for it. + +Count these records when you track denials, for example with `select(.action == "Denied")`. + +## Follow a Deny Trace + +HTTP Activity and API Activity records emitted inside a sampled OpenTelemetry span carry `trace.uid` and list `trace` in `metadata.profiles`. These are the classes OCSF 1.8.0 declares the Trace profile for. The UID is the W3C trace ID, 32 lowercase hexadecimal characters. Search for it in your Jaeger or Tempo backend. A sampled ID does not guarantee export or retention in the trace backend. + +```json +{ + "metadata": { "profiles": ["container", "host", "network_proxy", "security_control", "trace"] }, + "trace": { "uid": "0af7651916cd43dd8448eb211c80319c" } +} +``` + +OTLP log export links every OCSF record, whatever its class, to the active sampled span through the log record's own trace and span ID fields. Use those fields for log-to-trace links in your backend. + +With OTLP trace export enabled on a dedicated supervisor, denied HTTP requests can create an INFO `supervisor.egress.deny` span around the audit records for that decision. The span records the policy, reason, and destination when available. At the default log level, every deny span is a root span. At debug level, FORWARD policy, destination, credential-binding, and request middleware denials can join the available connect trace and its authorization, resolve, and dial spans. Other deny spans, including L7 denials inside CONNECT tunnels and response middleware denials, remain root spans. Shared supervisor hosts do not initialize OTLP exporters, so their records carry no trace correlation. Workload `traceparent` headers never supply supervisor correlation. + +To bound telemetry volume when a workload retries blocked destinations, the supervisor creates at most 10 deny spans per destination at once and one more per second after that. A process-wide budget also allows at most 100 spans at once and refills at 100 per second across destinations. Rate-limited decisions create no additional deny span, while all audit records are still emitted. Records can retain correlation to an already active sampled span, including a connect span at debug level. + +Gateway records and their OTLP trace context can inherit the caller's incoming `traceparent`, including before authentication succeeds. The caller also decides whether they are correlated at all, because an unsampled `traceparent` suppresses `trace.uid`. Treat gateway trace IDs as correlation hints, not evidence of the caller's identity, and do not treat a missing `trace.uid` as meaningful. + ## OCSF Event Classes in JSON The `class_uid` field identifies the event type: