From bb96bb570bc786063bdeae2053726eba952a5ca0 Mon Sep 17 00:00:00 2001 From: Harry Turner Date: Thu, 5 Nov 2026 09:03:05 -0800 Subject: [PATCH 01/12] feat(ocsf): correlate audit events with sampled OpenTelemetry traces Add optional trace.uid enrichment through a plain sampled-context extractor, with explicit correlation taking precedence on all ten event builders. Register the extractor at gateway and supervisor startup and keep an INFO span active around network and HTTP deny emissions at the default log level. Integrate the Authentication event and current network APIs while retaining sanitization, policy decisions, credential handling and conditional DEBUG parenting. Document per-decision traces and export/retention limits. Signed-off-by: Harry Turner Signed-off-by: Kris Hicks --- Cargo.lock | 2 + crates/openshell-ocsf-validate/README.md | 31 + .../schemas/test_trace_schema.py | 187 + .../schemas/trace_schema.py | 201 + .../openshell-ocsf-validate/schemas/update.sh | 28 +- ...container+host+security_control+trace.json | 8273 +++++++++++++++ ...ity@ai_operation+container+host+trace.json | 8138 ++++++++++++++ ...operation+host+security_control+trace.json | 8241 ++++++++++++++ .../api_activity@ai_operation+host+trace.json | 8106 ++++++++++++++ ...container+host+security_control+trace.json | 8265 +++++++++++++++ .../api_activity@container+host+trace.json | 8130 ++++++++++++++ ..._activity@host+security_control+trace.json | 8233 ++++++++++++++ .../v1.8.0/api_activity@host+trace.json | 8098 ++++++++++++++ ...cation_lifecycle@container+host+trace.json | 6945 ++++++++++++ ...ntication@host+security_control+trace.json | 7807 ++++++++++++++ .../base_event@container+host+trace.json | 6932 ++++++++++++ ...container+host+security_control+trace.json | 9438 +++++++++++++++++ ...n_finding@host+security_control+trace.json | 9406 ++++++++++++++++ ...container+host+security_control+trace.json | 7170 +++++++++++++ ...+network_proxy+security_control+trace.json | 8326 +++++++++++++++ ...+network_proxy+security_control+trace.json | 8259 +++++++++++++++ ...container+host+security_control+trace.json | 7745 ++++++++++++++ ...container+host+security_control+trace.json | 8279 +++++++++++++++ .../src/builders/api_activity.rs | 13 + .../src/builders/authentication.rs | 12 + crates/openshell-ocsf/src/builders/base.rs | 13 + crates/openshell-ocsf/src/builders/config.rs | 13 + crates/openshell-ocsf/src/builders/finding.rs | 13 + crates/openshell-ocsf/src/builders/http.rs | 15 + .../openshell-ocsf/src/builders/lifecycle.rs | 13 + crates/openshell-ocsf/src/builders/network.rs | 15 + crates/openshell-ocsf/src/builders/process.rs | 14 + crates/openshell-ocsf/src/builders/ssh.rs | 14 + .../openshell-ocsf/src/events/base_event.rs | 22 +- crates/openshell-ocsf/src/events/mod.rs | 16 + crates/openshell-ocsf/src/lib.rs | 3 + crates/openshell-ocsf/src/trace.rs | 239 + .../src/tracing_layers/event_bridge.rs | 6 +- crates/openshell-otel/src/correlation.rs | 26 + crates/openshell-otel/src/lib.rs | 24 + crates/openshell-otel/src/ocsf.rs | 30 + .../openshell-otel/tests/ocsf_correlation.rs | 239 + crates/openshell-server/src/cli.rs | 4 + .../openshell-supervisor-network/Cargo.toml | 2 + .../src/google_cloud_metadata.rs | 37 +- .../src/l7/middleware.rs | 277 +- .../src/l7/mod.rs | 15 +- .../src/l7/relay.rs | 123 +- .../src/l7/rest.rs | 237 +- .../src/l7/rest/http_response.rs | 335 +- .../src/l7/token_grant_injection.rs | 7 +- .../src/l7/websocket.rs | 74 +- .../openshell-supervisor-network/src/lib.rs | 1 + .../src/policy_dns/mod.rs | 11 +- .../openshell-supervisor-network/src/proxy.rs | 309 +- .../src/proxy/tests/compatibility.rs | 2 + .../src/proxy/trace_tests.rs | 629 ++ .../src/telemetry.rs | 137 + .../src/telemetry/tests.rs | 363 + crates/openshell-supervisor/src/main.rs | 26 +- docs/observability/ocsf-json-export.mdx | 58 + 61 files changed, 149312 insertions(+), 315 deletions(-) create mode 100644 crates/openshell-ocsf-validate/schemas/test_trace_schema.py create mode 100644 crates/openshell-ocsf-validate/schemas/trace_schema.py create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/application_lifecycle@container+host+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/authentication@host+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/base_event@container+host+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@container+host+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@host+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/device_config_state_change@container+host+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/network_activity@container+host+network_proxy+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/process_activity@container+host+security_control+trace.json create mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/ssh_activity@container+host+security_control+trace.json create mode 100644 crates/openshell-ocsf/src/trace.rs create mode 100644 crates/openshell-otel/src/correlation.rs create mode 100644 crates/openshell-otel/tests/ocsf_correlation.rs create mode 100644 crates/openshell-supervisor-network/src/proxy/trace_tests.rs create mode 100644 crates/openshell-supervisor-network/src/telemetry.rs create mode 100644 crates/openshell-supervisor-network/src/telemetry/tests.rs diff --git a/Cargo.lock b/Cargo.lock index 3932bee044..94cc7b3df6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5333,11 +5333,13 @@ dependencies = [ "openshell-ocsf", "openshell-ocsf-validate", "openshell-otel", + "openshell-otel-test-support", "openshell-policy", "openshell-policy-schema", "openshell-sandbox-backend", "openshell-supervisor-middleware", "openshell-supervisor-middleware-builtins", + "opentelemetry-proto", "opentelemetry_sdk", "prost-types", "rcgen", diff --git a/crates/openshell-ocsf-validate/README.md b/crates/openshell-ocsf-validate/README.md index 98d6c717a8..c1406eded9 100644 --- a/crates/openshell-ocsf-validate/README.md +++ b/crates/openshell-ocsf-validate/README.md @@ -16,8 +16,39 @@ crates/openshell-ocsf-validate/schemas/update.sh crates/openshell-ocsf-validate/ Without arguments, `schemas/update.sh` refetches every vendored schema. The schema server takes up to a few minutes per export. The build embeds every file under `schemas/v*/`, so tests need no source checkout at run time. +### Trace profile + +The OCSF 1.8.0 schema server exports the Trace profile for HTTP Activity and API Activity. For the other eight classes OpenShell emits, requesting `profiles=trace` returns a schema without a `trace` property. A successful HTTP response alone therefore does not establish Trace support. + +OpenShell extends the optional Trace profile to Base Event, Application Lifecycle, Authentication, Detection Finding, Device Config State Change, Network Activity, Process Activity, and SSH Activity. Those Trace schema variants contain a `$comment` that identifies the extension. They are official class exports plus an OpenShell extension, rather than unmodified official exports for those profile combinations. + +For these eight classes, `schemas/trace_schema.py` copies the `trace` property and its complete definition closure (`trace`, `span`, `service`, and `key_value_object`) unchanged from the [official HTTP Activity export](https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace). It preserves every other class constraint, including required fields and rejection of undefined attributes. It rejects conflicting shared definitions, malformed or unresolved Trace definitions, unsupported versions, and invalid profile names or ordering. HTTP/API variants retain their native Trace exports after the same definition checks. The validator still selects an exact profile combination; it does not accept arbitrary additional fields or profiles. + +Each of the 18 existing untraced profile combinations has a sibling with `+trace` in its name. To regenerate only these Trace variants from the repository root: + +```shell +trace_schemas=() +for schema in crates/openshell-ocsf-validate/schemas/v1.8.0/*.json; do + case "$schema" in *+trace.json) continue ;; esac + trace_schemas+=("${schema%.json}+trace.json") +done +crates/openshell-ocsf-validate/schemas/update.sh "${trace_schemas[@]}" +``` + +This leaves the existing untraced schemas untouched. The updater uses `uv` for its Python formatting and composition steps. Trace outputs sort JSON keys so repeated exports of the same schema content produce the same bytes. + +To reuse an already downloaded donor, set `OCSF_TRACE_SCHEMA_EXPORT` to the response file and `OCSF_TRACE_SCHEMA_SHA256` to its recorded SHA-256. The receipt must identify the exact OCSF 1.8.0 HTTP export URL above. The helper checks the hash and schema structure; it cannot independently establish the provenance or version of an arbitrary cache file because the schema server does not encode its version in `$id`. Preserve the download URL and response receipt alongside the hash. + +Run the composition safeguards without a Rust build: + +```shell +uv run --no-project python -m unittest discover -s crates/openshell-ocsf-validate/schemas -p 'test_trace_schema.py' +``` + ## Changing OCSF versions +Trace composition is deliberately restricted to OCSF 1.8.0. Review the newer version's profile applicability and definitions before updating `trace_schema.py` to permit it. + Each version's schemas live in their own directory, so a version change can land in steps: 1. Run `schemas/update.sh` with the current version's file names under `schemas/v/`. Events labelled with the current version still validate against its schemas. diff --git a/crates/openshell-ocsf-validate/schemas/test_trace_schema.py b/crates/openshell-ocsf-validate/schemas/test_trace_schema.py new file mode 100644 index 0000000000..b0e8b91cd6 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/test_trace_schema.py @@ -0,0 +1,187 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +"""Fail-closed and constraint-preservation checks for Trace schema composition.""" + +import contextlib +import copy +import hashlib +import io +import json +import sys +import tempfile +import unittest +from pathlib import Path +from unittest import mock + +from trace_schema import DRAFT, main, prepare_schema + + +def exported(class_name="http_activity", uid=4002, trace=True): + schema = { + "$schema": DRAFT, + "$id": "https://schema.ocsf.io/schema/classes/" + class_name, + "type": "object", + "additionalProperties": False, + "required": ["class_uid", "time"], + "properties": {"class_uid": {"const": uid}, "time": {"type": "integer"}}, + "$defs": {"unrelated": {"enum": ["preserve"]}}, + } + if trace: + schema["properties"]["trace"] = {"$ref": "#/$defs/trace", "title": "Trace"} + schema["$defs"].update( + { + "trace": { + "type": "object", + "additionalProperties": False, + "required": ["uid"], + "properties": { + "uid": {"type": "string"}, + "span": {"$ref": "#/$defs/span"}, + "service": {"$ref": "#/$defs/service"}, + }, + }, + "span": { + "properties": { + "tags": {"items": {"$ref": "#/$defs/key_value_object"}} + } + }, + "service": {"type": "object", "additionalProperties": False}, + "key_value_object": {"type": "object", "required": ["key", "value"]}, + } + ) + return schema + + +class TraceSchemaTests(unittest.TestCase): + def compose(self, base, donor=None, **kwargs): + return prepare_schema( + base, + donor if donor is not None else exported(), + kwargs.get("class_name", "network_activity"), + kwargs.get("version", "1.8.0"), + kwargs.get( + "profiles", + ["container", "host", "network_proxy", "security_control", "trace"], + ), + ) + + def test_extension_preserves_all_unrelated_constraints_and_inputs(self): + base = exported("network_activity", 4001, False) + donor = exported() + original = copy.deepcopy(base) + donor_original = copy.deepcopy(donor) + result = self.compose(base, donor) + self.assertIn("OpenShell extension", result.pop("$comment")) + self.assertEqual( + result["properties"].pop("trace"), donor["properties"]["trace"] + ) + for name in ["trace", "span", "service", "key_value_object"]: + self.assertEqual(result["$defs"].pop(name), donor["$defs"][name]) + self.assertEqual(result, original) + self.assertEqual(base, original) + self.assertEqual(donor, donor_original) + + def test_native_export_is_returned_without_extension(self): + native = exported("api_activity", 6003) + result = self.compose( + native, class_name="api_activity", profiles=["host", "trace"] + ) + self.assertEqual(result, native) + self.assertNotIn("$comment", result) + + def test_conflicting_shared_definition_is_rejected(self): + base = exported("network_activity", 4001, False) + base["$defs"]["service"] = {"type": "string"} + with self.assertRaisesRegex(ValueError, "conflicting shared definition"): + self.compose(base) + + def test_missing_or_widened_trace_definition_is_rejected(self): + for change in [ + "missing_uid", + "allow_extra", + "missing_span", + "external_reference", + ]: + with self.subTest(change=change): + donor = exported() + if change == "missing_uid": + donor["$defs"]["trace"]["required"] = [] + elif change == "allow_extra": + donor["$defs"]["trace"]["additionalProperties"] = True + elif change == "missing_span": + del donor["$defs"]["span"] + else: + donor["properties"]["trace"]["$ref"] = ( + "https://example.invalid/trace" + ) + with self.assertRaises(ValueError): + self.compose(exported("network_activity", 4001, False), donor) + + def test_wrong_class_version_and_profiles_are_rejected(self): + cases = [ + {"version": "1.9.0"}, + {"profiles": ["host", "invented", "trace"]}, + {"profiles": ["trace", "host"]}, + {"profiles": ["host", "trace", "trace"]}, + {"profiles": ["host"]}, + {"class_name": "base_event"}, + ] + for case in cases: + with self.subTest(case=case), self.assertRaises(ValueError): + self.compose(exported("network_activity", 4001, False), **case) + + def test_native_class_without_trace_and_changed_extension_applicability_fail(self): + with self.assertRaisesRegex(ValueError, "missing official Trace"): + self.compose( + exported("http_activity", 4002, False), class_name="http_activity" + ) + with self.assertRaisesRegex(ValueError, "now exports Trace natively"): + self.compose(exported("network_activity", 4001)) + + def test_cached_donor_requires_recorded_hash_and_matching_bytes(self): + with tempfile.TemporaryDirectory() as directory: + version = Path(directory) / "v1.8.0" + version.mkdir() + plain = version / "network_activity@host.json" + plain.write_text(json.dumps(exported("network_activity", 4001, False))) + target = version / "network_activity@host+trace.json" + donor = Path(directory) / "http.json" + donor.write_text(json.dumps(exported())) + argv = ["trace_schema.py", str(target), str(plain), str(donor)] + for expected in ["", "0" * 64]: + with ( + self.subTest(expected=expected), + mock.patch.object(sys, "argv", argv), + mock.patch.dict( + "os.environ", + { + "OCSF_TRACE_SCHEMA_EXPORT": str(donor), + "OCSF_TRACE_SCHEMA_SHA256": expected, + }, + ), + self.assertRaisesRegex(ValueError, "SHA-256|SHA256"), + ): + main() + output = io.StringIO() + with ( + mock.patch.object(sys, "argv", argv), + contextlib.redirect_stdout(output), + mock.patch.dict( + "os.environ", + { + "OCSF_TRACE_SCHEMA_EXPORT": str(donor), + "OCSF_TRACE_SCHEMA_SHA256": hashlib.sha256( + donor.read_bytes() + ).hexdigest(), + }, + ), + ): + main() + self.assertIn( + "OpenShell extension", json.loads(output.getvalue())["$comment"] + ) + + +if __name__ == "__main__": + unittest.main() diff --git a/crates/openshell-ocsf-validate/schemas/trace_schema.py b/crates/openshell-ocsf-validate/schemas/trace_schema.py new file mode 100644 index 0000000000..55f54a2e51 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/trace_schema.py @@ -0,0 +1,201 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +"""Prepare Trace-profile exports without relaxing unrelated OCSF constraints. + +The server exports Trace on HTTP/API Activity only. Other supported classes use +an explicitly marked OpenShell extension composed from the official HTTP export. +Run through update.sh, which fetches both inputs for the requested OCSF version. +""" + +import copy +import hashlib +import json +import os +import sys +from pathlib import Path + +CLASS_UIDS = { + "api_activity": 6003, + "application_lifecycle": 6002, + "authentication": 3002, + "base_event": 0, + "detection_finding": 2004, + "device_config_state_change": 5019, + "http_activity": 4002, + "network_activity": 4001, + "process_activity": 1007, + "ssh_activity": 4007, +} +NATIVE_TRACE_CLASSES = {"api_activity", "http_activity"} +TRACE_DEFINITIONS = {"trace", "span", "service", "key_value_object"} +PROFILES = { + "ai_operation", + "container", + "host", + "network_proxy", + "security_control", + "trace", +} +DRAFT = "http://json-schema.org/draft-07/schema#" + + +def require(condition, message): + if not condition: + raise ValueError(message) + + +def references(value): + if isinstance(value, dict): + for key, child in value.items(): + if key == "$ref": + yield child + else: + yield from references(child) + elif isinstance(value, list): + for child in value: + yield from references(child) + + +def check_class(schema, name): + require(isinstance(schema, dict), "export must be a JSON object") + require(schema.get("$schema") == DRAFT, "unexpected JSON Schema draft") + require(schema.get("$id", "").endswith("/classes/" + name), "class ID URL mismatch") + require(schema.get("type") == "object", "event schema must describe an object") + require( + schema.get("additionalProperties") is False, + "event schema must reject undefined fields", + ) + require( + schema.get("properties", {}).get("class_uid", {}).get("const") + == CLASS_UIDS[name], + "class_uid mismatch", + ) + + +def trace_closure(schema): + prop = schema.get("properties", {}).get("trace") + require( + isinstance(prop, dict) and prop.get("$ref") == "#/$defs/trace", + "missing official Trace property", + ) + definitions = schema.get("$defs", {}) + found = set() + pending = list(references(prop)) + while pending: + ref = pending.pop() + require( + isinstance(ref, str) and ref.startswith("#/$defs/"), + "non-local Trace reference", + ) + name = ref[len("#/$defs/") :] + require(name in TRACE_DEFINITIONS, "unexpected Trace definition: " + name) + if name in found: + continue + require(name in definitions, "unresolved Trace reference: " + name) + found.add(name) + pending.extend(references(definitions[name])) + require(found == TRACE_DEFINITIONS, "incomplete official Trace definition closure") + trace = definitions["trace"] + require( + trace.get("type") == "object" and trace.get("additionalProperties") is False, + "malformed Trace object", + ) + require( + trace.get("properties", {}).get("uid", {}).get("type") == "string", + "Trace UID must be a string", + ) + require(trace.get("required") == ["uid"], "unexpected required Trace attributes") + return prop, {name: definitions[name] for name in sorted(found)} + + +def prepare_schema(schema, donor, class_name, version, profiles): + require(version == "1.8.0", "Trace composition is reviewed for OCSF 1.8.0 only") + require(class_name in CLASS_UIDS, "unsupported event class") + require(profiles == sorted(set(profiles)), "profiles must be unique and sorted") + require( + "trace" in profiles and set(profiles) <= PROFILES, + "unsupported Trace profile combination", + ) + require( + "ai_operation" not in profiles or class_name == "api_activity", + "AI profile requires API Activity", + ) + require( + "network_proxy" not in profiles + or class_name in {"http_activity", "network_activity"}, + "network proxy profile requires HTTP/Network Activity", + ) + check_class(schema, class_name) + check_class(donor, "http_activity") + trace_property, definitions = trace_closure(donor) + if class_name in NATIVE_TRACE_CLASSES: + native_property, native_definitions = trace_closure(schema) + require( + native_property == trace_property and native_definitions == definitions, + "native Trace export differs from the HTTP donor", + ) + return copy.deepcopy(schema) + require( + "trace" not in schema["properties"], + "class now exports Trace natively; review extension applicability", + ) + result = copy.deepcopy(schema) + result["properties"]["trace"] = copy.deepcopy(trace_property) + result_definitions = result.setdefault("$defs", {}) + for name, definition in definitions.items(): + require( + name not in result_definitions or result_definitions[name] == definition, + "conflicting shared definition: " + name, + ) + result_definitions[name] = copy.deepcopy(definition) + result["$comment"] = ( + "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for " + + class_name + + ". The optional trace property and its definition closure are copied unchanged from " + "https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. " + "All other class constraints are preserved. Regenerate with schemas/update.sh." + ) + return result + + +def main(): + require( + len(sys.argv) == 4, + "usage: trace_schema.py TARGET CLASS_EXPORT HTTP_TRACE_EXPORT", + ) + target, class_export, donor_export = map(Path, sys.argv[1:]) + require( + target.parent.name.startswith("v"), "target must name an OCSF version directory" + ) + require("@" in target.stem, "target must name its profiles") + class_name, profile_names = target.stem.split("@", 1) + profiles = profile_names.split("+") + untraced = target.with_name( + class_name + "@" + "+".join(p for p in profiles if p != "trace") + ".json" + ) + require( + untraced.is_file(), + "vendor the corresponding untraced profile combination first", + ) + if os.environ.get("OCSF_TRACE_SCHEMA_EXPORT"): + expected = os.environ.get("OCSF_TRACE_SCHEMA_SHA256", "") + require( + len(expected) == 64 and all(c in "0123456789abcdef" for c in expected), + "a cached donor requires OCSF_TRACE_SCHEMA_SHA256 from its source receipt", + ) + require( + hashlib.sha256(donor_export.read_bytes()).hexdigest() == expected, + "cached donor SHA-256 mismatch", + ) + schema = json.loads(class_export.read_text()) + donor = json.loads(donor_export.read_text()) + result = prepare_schema(schema, donor, class_name, target.parent.name[1:], profiles) + print(json.dumps(result, indent=2, sort_keys=True)) + + +if __name__ == "__main__": + try: + main() + except (ValueError, KeyError, TypeError) as error: + raise SystemExit("Trace schema generation failed: " + str(error)) from error diff --git a/crates/openshell-ocsf-validate/schemas/update.sh b/crates/openshell-ocsf-validate/schemas/update.sh index 3fbd2032ac..dca9bbbc63 100755 --- a/crates/openshell-ocsf-validate/schemas/update.sh +++ b/crates/openshell-ocsf-validate/schemas/update.sh @@ -5,11 +5,14 @@ # Fetch vendored schemas from the OCSF schema server: the files given, which # need not exist yet, or every file under v*/. Each file is # `v/@+.json`. +# Trace variants use the native export or the documented OpenShell composition. set -euo pipefail +OCSF_SCHEMA_TOOL_DIR="$(cd "$(dirname "$0")" && pwd)" +export OCSF_SCHEMA_TOOL_DIR fetch() { set -euo pipefail - local file="$1" name version class profiles="" tmp + local file="$1" name version class profiles="" tmp formatted donor name="$(basename "$file" .json)" version="$(basename "$(dirname "$file")")" version="${version#v}" @@ -19,12 +22,27 @@ fetch() { profiles="${profiles//+/,}" fi tmp="$(mktemp)" + formatted="$(mktemp)" curl -sSfL --retry 3 --max-time 600 \ - "https://schema.ocsf.io/schema/${version}/classes/${class}?profiles=${profiles}" \ - | python3 -m json.tool --indent 2 > "$tmp" - chmod 644 "$tmp" + "https://schema.ocsf.io/schema/${version}/classes/${class}?profiles=${profiles}" > "$tmp" + if [[ ",${profiles}," == *,trace,* ]]; then + donor="$(mktemp)" + if [[ -n "${OCSF_TRACE_SCHEMA_EXPORT:-}" ]]; then + cp "$OCSF_TRACE_SCHEMA_EXPORT" "$donor" + else + curl -sSfL --retry 3 --max-time 600 \ + "https://schema.ocsf.io/schema/${version}/classes/http_activity?profiles=container,host,network_proxy,security_control,trace" > "$donor" + fi + uv run --no-project python "$OCSF_SCHEMA_TOOL_DIR/trace_schema.py" \ + "$file" "$tmp" "$donor" > "$formatted" + rm -f "$donor" + else + uv run --no-project python -m json.tool --indent 2 "$tmp" > "$formatted" + fi + chmod 644 "$formatted" mkdir -p "$(dirname "$file")" - mv "$tmp" "$file" + mv "$formatted" "$file" + rm -f "$tmp" echo "fetched v${version}/${name}" } export -f fetch diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json new file mode 100644 index 0000000000..0bac20738b --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json @@ -0,0 +1,8273 @@ +{ + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json new file mode 100644 index 0000000000..af3391c00d --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json @@ -0,0 +1,8138 @@ +{ + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "message": { + "title": "Message", + "type": "string" + }, + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json new file mode 100644 index 0000000000..ba8a7817d8 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json @@ -0,0 +1,8241 @@ +{ + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json new file mode 100644 index 0000000000..396b82bfe1 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json @@ -0,0 +1,8106 @@ +{ + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "message": { + "title": "Message", + "type": "string" + }, + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json new file mode 100644 index 0000000000..2618bbd2e5 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json @@ -0,0 +1,8265 @@ +{ + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json new file mode 100644 index 0000000000..0dcdad87a1 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json @@ -0,0 +1,8130 @@ +{ + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json new file mode 100644 index 0000000000..2d5ab8351c --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json @@ -0,0 +1,8233 @@ +{ + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json new file mode 100644 index 0000000000..af955c32f7 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json @@ -0,0 +1,8098 @@ +{ + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/api_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "actor", + "api", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "src_endpoint", + "time", + "type_uid" + ], + "title": "API Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/application_lifecycle@container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/application_lifecycle@container+host+trace.json new file mode 100644 index 0000000000..3b41a46c79 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/application_lifecycle@container+host+trace.json @@ -0,0 +1,6945 @@ +{ + "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for application_lifecycle. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/application_lifecycle", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "app": { + "$ref": "#/$defs/product", + "title": "Application" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 6002, + "title": "Class ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "app", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "time", + "type_uid" + ], + "title": "Application Lifecycle", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/authentication@host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/authentication@host+security_control+trace.json new file mode 100644 index 0000000000..17a7abba54 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/authentication@host+security_control+trace.json @@ -0,0 +1,7807 @@ +{ + "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for authentication. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authentication_token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "kerberos_flags": { + "title": "Kerberos Flags", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Authentication Token", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/authentication", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "dst_endpoint" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "account_switch_type": { + "title": "Account Switch Type", + "type": "string" + }, + "account_switch_type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Account Switch Type ID", + "type": "integer" + }, + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "authentication_token": { + "$ref": "#/$defs/authentication_token", + "title": "Authentication Token" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 3, + "title": "Category ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 3002, + "title": "Class ID", + "type": "integer" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "is_cleartext": { + "title": "Cleartext Credentials", + "type": "boolean" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_new_logon": { + "title": "New Logon", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "logon_process": { + "$ref": "#/$defs/process", + "title": "Logon Process" + }, + "logon_type": { + "title": "Logon Type", + "type": "string" + }, + "logon_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 99 + ], + "title": "Logon Type ID", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "required": [ + "activity_id", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "time", + "type_uid", + "user" + ], + "title": "Authentication", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/base_event@container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/base_event@container+host+trace.json new file mode 100644 index 0000000000..234e1bf377 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/base_event@container+host+trace.json @@ -0,0 +1,6932 @@ +{ + "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for base_event. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/base_event", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "activity_id": { + "enum": [ + 0, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 0, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 0, + "title": "Class ID", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "time", + "type_uid" + ], + "title": "Base Event", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@container+host+security_control+trace.json new file mode 100644 index 0000000000..230c0c8b74 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@container+host+security_control+trace.json @@ -0,0 +1,9438 @@ +{ + "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for detection_finding. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "analysis_target": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Analysis Target", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "anomaly": { + "additionalProperties": false, + "properties": { + "observation_parameter": { + "title": "Observation Parameter", + "type": "string" + }, + "observation_type": { + "title": "Observation Type", + "type": "string" + }, + "observations": { + "items": { + "$ref": "#/$defs/observation" + }, + "title": "Observations", + "type": "array" + }, + "observed_pattern": { + "title": "Observed Pattern", + "type": "string" + } + }, + "required": [ + "observation_parameter", + "observations" + ], + "title": "Anomaly", + "type": "object" + }, + "anomaly_analysis": { + "additionalProperties": false, + "properties": { + "analysis_targets": { + "items": { + "$ref": "#/$defs/analysis_target" + }, + "title": "Analysis Targets", + "type": "array" + }, + "anomalies": { + "items": { + "$ref": "#/$defs/anomaly" + }, + "title": "Anomalies", + "type": "array" + }, + "baselines": { + "items": { + "$ref": "#/$defs/baseline" + }, + "title": "Baselines", + "type": "array" + } + }, + "required": [ + "analysis_targets", + "anomalies" + ], + "title": "Anomaly Analysis", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "baseline": { + "additionalProperties": false, + "properties": { + "observation_parameter": { + "title": "Observation Parameter", + "type": "string" + }, + "observation_type": { + "title": "Observation Type", + "type": "string" + }, + "observations": { + "items": { + "$ref": "#/$defs/observation" + }, + "title": "Observations", + "type": "array" + }, + "observed_pattern": { + "title": "Observed Pattern", + "type": "string" + } + }, + "required": [ + "observation_parameter", + "observations" + ], + "title": "Baseline", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "database": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "embedding_model": { + "title": "Embedding Model", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Database", + "type": "object" + }, + "databucket": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_public": { + "title": "Public", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Databucket", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "dns_query": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "opcode": { + "title": "DNS Opcode", + "type": "string" + }, + "opcode_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "DNS Opcode ID", + "type": "integer" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "hostname" + ], + "title": "DNS Query", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "evidences": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "actor" + ] + }, + { + "required": [ + "api" + ] + }, + { + "required": [ + "connection_info" + ] + }, + { + "required": [ + "data" + ] + }, + { + "required": [ + "database" + ] + }, + { + "required": [ + "databucket" + ] + }, + { + "required": [ + "device" + ] + }, + { + "required": [ + "dst_endpoint" + ] + }, + { + "required": [ + "email" + ] + }, + { + "required": [ + "file" + ] + }, + { + "required": [ + "job" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "query" + ] + }, + { + "required": [ + "reg_key" + ] + }, + { + "required": [ + "reg_value" + ] + }, + { + "required": [ + "script" + ] + }, + { + "required": [ + "src_endpoint" + ] + }, + { + "required": [ + "url" + ] + }, + { + "required": [ + "user" + ] + }, + { + "required": [ + "win_service" + ] + } + ], + "properties": { + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Connection Info" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "data": { + "title": "Data" + }, + "database": { + "$ref": "#/$defs/database", + "title": "Database" + }, + "databucket": { + "$ref": "#/$defs/databucket", + "title": "Databucket" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Email" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "ja4_fingerprint_list": { + "items": { + "$ref": "#/$defs/ja4_fingerprint" + }, + "title": "JA4+ Fingerprints", + "type": "array" + }, + "job": { + "$ref": "#/$defs/job", + "title": "Job" + }, + "name": { + "title": "Name", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "query": { + "$ref": "#/$defs/dns_query", + "title": "DNS Query" + }, + "reg_key": { + "$ref": "#/$defs/win_reg_key", + "title": "Registry Key" + }, + "reg_value": { + "$ref": "#/$defs/win_reg_value", + "title": "Registry Value" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Cloud Resources", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Script" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "tls": { + "$ref": "#/$defs/tls", + "title": "TLS" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "verdict": { + "title": "Verdict", + "type": "string" + }, + "verdict_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Verdict ID", + "type": "integer" + }, + "win_service": { + "$ref": "#/$defs/win_win_service", + "title": "Windows Service" + } + }, + "title": "Evidence Artifacts", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "finding_info": { + "additionalProperties": false, + "properties": { + "analytic": { + "$ref": "#/$defs/analytic", + "title": "Analytic" + }, + "attack_graph": { + "$ref": "#/$defs/graph", + "title": "Attack Graph" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data_sources": { + "items": { + "type": "string" + }, + "title": "Data Sources", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "product_uid": { + "title": "Product Identifier", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "related_events": { + "items": { + "$ref": "#/$defs/related_event" + }, + "title": "Related Events/Findings", + "type": "array" + }, + "related_events_count": { + "title": "Related Events/Findings Count", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "traits": { + "items": { + "$ref": "#/$defs/trait" + }, + "title": "Traits", + "type": "array" + }, + "types": { + "items": { + "type": "string" + }, + "title": "Types", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Finding Information", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "ja4_fingerprint": { + "additionalProperties": false, + "properties": { + "section_a": { + "title": "JA4 Section A", + "type": "string" + }, + "section_b": { + "title": "JA4 Section B", + "type": "string" + }, + "section_c": { + "title": "JA4 Section C", + "type": "string" + }, + "section_d": { + "title": "JA4 Section D", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "JA4+ Fingerprint", + "type": "object" + }, + "job": { + "additionalProperties": false, + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "last_run_time": { + "title": "Last Run", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "next_run_time": { + "title": "Next Run", + "type": "integer" + }, + "run_state": { + "title": "Run State", + "type": "string" + }, + "run_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Run State ID", + "type": "integer" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "required": [ + "name" + ], + "title": "Job", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_connection_info": { + "additionalProperties": false, + "properties": { + "boundary": { + "title": "Boundary", + "type": "string" + }, + "boundary_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Boundary ID", + "type": "integer" + }, + "community_uid": { + "title": "Community ID", + "type": "string" + }, + "direction": { + "title": "Direction", + "type": "string" + }, + "direction_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Direction ID", + "type": "integer" + }, + "flag_history": { + "title": "Connection Flag History", + "type": "string" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + }, + "protocol_ver": { + "title": "IP Version", + "type": "string" + }, + "protocol_ver_id": { + "enum": [ + 0, + 4, + 6, + 99 + ], + "title": "IP Version ID", + "type": "integer" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "tcp_flags": { + "title": "TCP Flags", + "type": "integer" + }, + "uid": { + "title": "Connection UID", + "type": "string" + } + }, + "required": [ + "direction_id" + ], + "title": "Network Connection Information", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "observation": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "timespan": { + "$ref": "#/$defs/timespan", + "title": "Time Span" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Observation", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "related_event": { + "additionalProperties": false, + "properties": { + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "product_uid": { + "title": "Product Identifier", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "traits": { + "items": { + "$ref": "#/$defs/trait" + }, + "title": "Traits", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Related Event/Finding", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "ticket": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Ticket Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Ticket Status ID", + "type": "integer" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Ticket Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Ticket Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Ticket", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "tls": { + "additionalProperties": false, + "properties": { + "alert": { + "title": "Client TLS Alert", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "certificate_chain": { + "items": { + "type": "string" + }, + "title": "Certificate Chain", + "type": "array" + }, + "cipher": { + "title": "Cipher Suite", + "type": "string" + }, + "client_ciphers": { + "items": { + "type": "string" + }, + "title": "Client Cipher Suites", + "type": "array" + }, + "extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "Extension List", + "type": "array" + }, + "handshake_dur": { + "title": "Handshake Duration", + "type": "integer" + }, + "ja3_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3 Hash" + }, + "ja3s_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3S Hash" + }, + "key_length": { + "title": "Key Length", + "type": "integer" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "server_ciphers": { + "items": { + "type": "string" + }, + "title": "Server Cipher Suites", + "type": "array" + }, + "sni": { + "title": "Server Name Indication", + "type": "string" + }, + "tls_extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "TLS Extension List", + "type": "array" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Transport Layer Security (TLS)", + "type": "object" + }, + "tls_extension": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 5, + 10, + 13, + 14, + 15, + 16, + 18, + 19, + 20, + 21, + 41, + 42, + 43, + 44, + 45, + 47, + 48, + 49, + 50, + 51, + 99 + ], + "title": "Type ID", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "TLS Extension", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "trait": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "title": "Trait", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vendor_attributes": { + "additionalProperties": false, + "properties": { + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + } + }, + "title": "Vendor Attributes", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_reg_key": { + "additionalProperties": false, + "properties": { + "is_system": { + "title": "System", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + } + }, + "required": [ + "path" + ], + "title": "Registry Key", + "type": "object" + }, + "win_reg_value": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "is_default": { + "title": "Default Value", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "reg_binary_data": { + "title": "Registry Binary Data", + "type": "string" + }, + "reg_integer_data": { + "title": "Registry Integer Data", + "type": "integer" + }, + "reg_string_data": { + "title": "Registry String Data", + "type": "string" + }, + "reg_string_list_data": { + "items": { + "type": "string" + }, + "title": "Registry String List Data", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Type ID", + "type": "integer" + } + }, + "required": [ + "name", + "path" + ], + "title": "Registry Value", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/detection_finding", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "anomaly_analyses": { + "items": { + "$ref": "#/$defs/anomaly_analysis" + }, + "title": "Anomaly Analyses", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 2, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 2004, + "title": "Class ID", + "type": "integer" + }, + "comment": { + "title": "Comment", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "evidences": { + "items": { + "$ref": "#/$defs/evidences" + }, + "title": "Evidence Artifacts", + "type": "array" + }, + "finding_info": { + "$ref": "#/$defs/finding_info", + "title": "Finding Information" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "impact": { + "title": "Impact", + "type": "string" + }, + "impact_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Impact ID", + "type": "integer" + }, + "impact_score": { + "title": "Impact Score", + "type": "integer" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Affected Resources", + "type": "array" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "vendor_attributes": { + "$ref": "#/$defs/vendor_attributes", + "title": "Vendor Attributes" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Vulnerabilities", + "type": "array" + } + }, + "required": [ + "activity_id", + "category_uid", + "class_uid", + "finding_info", + "metadata", + "severity_id", + "time", + "type_uid" + ], + "title": "Detection Finding", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@host+security_control+trace.json new file mode 100644 index 0000000000..28b22c07fc --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@host+security_control+trace.json @@ -0,0 +1,9406 @@ +{ + "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for detection_finding. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "analysis_target": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Analysis Target", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "anomaly": { + "additionalProperties": false, + "properties": { + "observation_parameter": { + "title": "Observation Parameter", + "type": "string" + }, + "observation_type": { + "title": "Observation Type", + "type": "string" + }, + "observations": { + "items": { + "$ref": "#/$defs/observation" + }, + "title": "Observations", + "type": "array" + }, + "observed_pattern": { + "title": "Observed Pattern", + "type": "string" + } + }, + "required": [ + "observation_parameter", + "observations" + ], + "title": "Anomaly", + "type": "object" + }, + "anomaly_analysis": { + "additionalProperties": false, + "properties": { + "analysis_targets": { + "items": { + "$ref": "#/$defs/analysis_target" + }, + "title": "Analysis Targets", + "type": "array" + }, + "anomalies": { + "items": { + "$ref": "#/$defs/anomaly" + }, + "title": "Anomalies", + "type": "array" + }, + "baselines": { + "items": { + "$ref": "#/$defs/baseline" + }, + "title": "Baselines", + "type": "array" + } + }, + "required": [ + "analysis_targets", + "anomalies" + ], + "title": "Anomaly Analysis", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "baseline": { + "additionalProperties": false, + "properties": { + "observation_parameter": { + "title": "Observation Parameter", + "type": "string" + }, + "observation_type": { + "title": "Observation Type", + "type": "string" + }, + "observations": { + "items": { + "$ref": "#/$defs/observation" + }, + "title": "Observations", + "type": "array" + }, + "observed_pattern": { + "title": "Observed Pattern", + "type": "string" + } + }, + "required": [ + "observation_parameter", + "observations" + ], + "title": "Baseline", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "database": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "embedding_model": { + "title": "Embedding Model", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Database", + "type": "object" + }, + "databucket": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_public": { + "title": "Public", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Databucket", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "dns_query": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "opcode": { + "title": "DNS Opcode", + "type": "string" + }, + "opcode_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "DNS Opcode ID", + "type": "integer" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "hostname" + ], + "title": "DNS Query", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "evidences": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "actor" + ] + }, + { + "required": [ + "api" + ] + }, + { + "required": [ + "connection_info" + ] + }, + { + "required": [ + "data" + ] + }, + { + "required": [ + "database" + ] + }, + { + "required": [ + "databucket" + ] + }, + { + "required": [ + "device" + ] + }, + { + "required": [ + "dst_endpoint" + ] + }, + { + "required": [ + "email" + ] + }, + { + "required": [ + "file" + ] + }, + { + "required": [ + "job" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "query" + ] + }, + { + "required": [ + "reg_key" + ] + }, + { + "required": [ + "reg_value" + ] + }, + { + "required": [ + "script" + ] + }, + { + "required": [ + "src_endpoint" + ] + }, + { + "required": [ + "url" + ] + }, + { + "required": [ + "user" + ] + }, + { + "required": [ + "win_service" + ] + } + ], + "properties": { + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Connection Info" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "data": { + "title": "Data" + }, + "database": { + "$ref": "#/$defs/database", + "title": "Database" + }, + "databucket": { + "$ref": "#/$defs/databucket", + "title": "Databucket" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Email" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "ja4_fingerprint_list": { + "items": { + "$ref": "#/$defs/ja4_fingerprint" + }, + "title": "JA4+ Fingerprints", + "type": "array" + }, + "job": { + "$ref": "#/$defs/job", + "title": "Job" + }, + "name": { + "title": "Name", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "query": { + "$ref": "#/$defs/dns_query", + "title": "DNS Query" + }, + "reg_key": { + "$ref": "#/$defs/win_reg_key", + "title": "Registry Key" + }, + "reg_value": { + "$ref": "#/$defs/win_reg_value", + "title": "Registry Value" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Cloud Resources", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Script" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "tls": { + "$ref": "#/$defs/tls", + "title": "TLS" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "verdict": { + "title": "Verdict", + "type": "string" + }, + "verdict_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Verdict ID", + "type": "integer" + }, + "win_service": { + "$ref": "#/$defs/win_win_service", + "title": "Windows Service" + } + }, + "title": "Evidence Artifacts", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "finding_info": { + "additionalProperties": false, + "properties": { + "analytic": { + "$ref": "#/$defs/analytic", + "title": "Analytic" + }, + "attack_graph": { + "$ref": "#/$defs/graph", + "title": "Attack Graph" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data_sources": { + "items": { + "type": "string" + }, + "title": "Data Sources", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "product_uid": { + "title": "Product Identifier", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "related_events": { + "items": { + "$ref": "#/$defs/related_event" + }, + "title": "Related Events/Findings", + "type": "array" + }, + "related_events_count": { + "title": "Related Events/Findings Count", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "traits": { + "items": { + "$ref": "#/$defs/trait" + }, + "title": "Traits", + "type": "array" + }, + "types": { + "items": { + "type": "string" + }, + "title": "Types", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Finding Information", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "ja4_fingerprint": { + "additionalProperties": false, + "properties": { + "section_a": { + "title": "JA4 Section A", + "type": "string" + }, + "section_b": { + "title": "JA4 Section B", + "type": "string" + }, + "section_c": { + "title": "JA4 Section C", + "type": "string" + }, + "section_d": { + "title": "JA4 Section D", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "JA4+ Fingerprint", + "type": "object" + }, + "job": { + "additionalProperties": false, + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "last_run_time": { + "title": "Last Run", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "next_run_time": { + "title": "Next Run", + "type": "integer" + }, + "run_state": { + "title": "Run State", + "type": "string" + }, + "run_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Run State ID", + "type": "integer" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "required": [ + "name" + ], + "title": "Job", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_connection_info": { + "additionalProperties": false, + "properties": { + "boundary": { + "title": "Boundary", + "type": "string" + }, + "boundary_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Boundary ID", + "type": "integer" + }, + "community_uid": { + "title": "Community ID", + "type": "string" + }, + "direction": { + "title": "Direction", + "type": "string" + }, + "direction_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Direction ID", + "type": "integer" + }, + "flag_history": { + "title": "Connection Flag History", + "type": "string" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + }, + "protocol_ver": { + "title": "IP Version", + "type": "string" + }, + "protocol_ver_id": { + "enum": [ + 0, + 4, + 6, + 99 + ], + "title": "IP Version ID", + "type": "integer" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "tcp_flags": { + "title": "TCP Flags", + "type": "integer" + }, + "uid": { + "title": "Connection UID", + "type": "string" + } + }, + "required": [ + "direction_id" + ], + "title": "Network Connection Information", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "observation": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "timespan": { + "$ref": "#/$defs/timespan", + "title": "Time Span" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Observation", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "related_event": { + "additionalProperties": false, + "properties": { + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "product_uid": { + "title": "Product Identifier", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "traits": { + "items": { + "$ref": "#/$defs/trait" + }, + "title": "Traits", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Related Event/Finding", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "resource_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" + }, + "role": { + "title": "Role", + "type": "string" + }, + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "ticket": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Ticket Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Ticket Status ID", + "type": "integer" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Ticket Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Ticket Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Ticket", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "tls": { + "additionalProperties": false, + "properties": { + "alert": { + "title": "Client TLS Alert", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "certificate_chain": { + "items": { + "type": "string" + }, + "title": "Certificate Chain", + "type": "array" + }, + "cipher": { + "title": "Cipher Suite", + "type": "string" + }, + "client_ciphers": { + "items": { + "type": "string" + }, + "title": "Client Cipher Suites", + "type": "array" + }, + "extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "Extension List", + "type": "array" + }, + "handshake_dur": { + "title": "Handshake Duration", + "type": "integer" + }, + "ja3_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3 Hash" + }, + "ja3s_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3S Hash" + }, + "key_length": { + "title": "Key Length", + "type": "integer" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "server_ciphers": { + "items": { + "type": "string" + }, + "title": "Server Cipher Suites", + "type": "array" + }, + "sni": { + "title": "Server Name Indication", + "type": "string" + }, + "tls_extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "TLS Extension List", + "type": "array" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Transport Layer Security (TLS)", + "type": "object" + }, + "tls_extension": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 5, + 10, + 13, + 14, + 15, + 16, + 18, + 19, + 20, + 21, + 41, + 42, + 43, + 44, + 45, + 47, + 48, + 49, + 50, + 51, + 99 + ], + "title": "Type ID", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "TLS Extension", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "trait": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "title": "Trait", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vendor_attributes": { + "additionalProperties": false, + "properties": { + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + } + }, + "title": "Vendor Attributes", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_reg_key": { + "additionalProperties": false, + "properties": { + "is_system": { + "title": "System", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + } + }, + "required": [ + "path" + ], + "title": "Registry Key", + "type": "object" + }, + "win_reg_value": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "is_default": { + "title": "Default Value", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "reg_binary_data": { + "title": "Registry Binary Data", + "type": "string" + }, + "reg_integer_data": { + "title": "Registry Integer Data", + "type": "integer" + }, + "reg_string_data": { + "title": "Registry String Data", + "type": "string" + }, + "reg_string_list_data": { + "items": { + "type": "string" + }, + "title": "Registry String List Data", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Type ID", + "type": "integer" + } + }, + "required": [ + "name", + "path" + ], + "title": "Registry Value", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/detection_finding", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "anomaly_analyses": { + "items": { + "$ref": "#/$defs/anomaly_analysis" + }, + "title": "Anomaly Analyses", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 2, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 2004, + "title": "Class ID", + "type": "integer" + }, + "comment": { + "title": "Comment", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "evidences": { + "items": { + "$ref": "#/$defs/evidences" + }, + "title": "Evidence Artifacts", + "type": "array" + }, + "finding_info": { + "$ref": "#/$defs/finding_info", + "title": "Finding Information" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "impact": { + "title": "Impact", + "type": "string" + }, + "impact_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Impact ID", + "type": "integer" + }, + "impact_score": { + "title": "Impact Score", + "type": "integer" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Affected Resources", + "type": "array" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "vendor_attributes": { + "$ref": "#/$defs/vendor_attributes", + "title": "Vendor Attributes" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Vulnerabilities", + "type": "array" + } + }, + "required": [ + "activity_id", + "category_uid", + "class_uid", + "finding_info", + "metadata", + "severity_id", + "time", + "type_uid" + ], + "title": "Detection Finding", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/device_config_state_change@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/device_config_state_change@container+host+security_control+trace.json new file mode 100644 index 0000000000..bb06a92d32 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/device_config_state_change@container+host+security_control+trace.json @@ -0,0 +1,7170 @@ +{ + "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for device_config_state_change. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "security_state": { + "additionalProperties": false, + "properties": { + "state": { + "title": "Security State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 99 + ], + "title": "Security State ID", + "type": "integer" + } + }, + "title": "Security State", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/device_config_state_change", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 5, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 5019, + "title": "Class ID", + "type": "integer" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "prev_security_level": { + "title": "Previous Security Level", + "type": "string" + }, + "prev_security_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Previous Security Level ID", + "type": "integer" + }, + "prev_security_states": { + "items": { + "$ref": "#/$defs/security_state" + }, + "title": "Previous Security States", + "type": "array" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "security_level": { + "title": "Security Level", + "type": "string" + }, + "security_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Security Level ID", + "type": "integer" + }, + "security_states": { + "items": { + "$ref": "#/$defs/security_state" + }, + "title": "Security States", + "type": "array" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "state": { + "title": "Config Change State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Config Change State ID", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "category_uid", + "class_uid", + "device", + "metadata", + "severity_id", + "time", + "type_uid" + ], + "title": "Device Config State Change", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json new file mode 100644 index 0000000000..e038fa211d --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json @@ -0,0 +1,8326 @@ +{ + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "endpoint_connection": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "code" + ] + }, + { + "required": [ + "network_endpoint" + ] + } + ], + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "network_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Network Endpoint" + } + }, + "title": "Endpoint Connection", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_cookie": { + "additionalProperties": false, + "properties": { + "domain": { + "title": "Domain", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "http_only": { + "title": "HTTP Only", + "type": "boolean" + }, + "is_http_only": { + "title": "HTTP Only", + "type": "boolean" + }, + "is_secure": { + "title": "Secure", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "samesite": { + "title": "SameSite", + "type": "string" + }, + "secure": { + "title": "Secure", + "type": "boolean" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Cookie", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "ja4_fingerprint": { + "additionalProperties": false, + "properties": { + "section_a": { + "title": "JA4 Section A", + "type": "string" + }, + "section_b": { + "title": "JA4 Section B", + "type": "string" + }, + "section_c": { + "title": "JA4 Section C", + "type": "string" + }, + "section_d": { + "title": "JA4 Section D", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "JA4+ Fingerprint", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "load_balancer": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification": { + "title": "Classification", + "type": "string" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "endpoint_connections": { + "items": { + "$ref": "#/$defs/endpoint_connection" + }, + "title": "Endpoint Connections", + "type": "array" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Load Balancer", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_connection_info": { + "additionalProperties": false, + "properties": { + "boundary": { + "title": "Boundary", + "type": "string" + }, + "boundary_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Boundary ID", + "type": "integer" + }, + "community_uid": { + "title": "Community ID", + "type": "string" + }, + "direction": { + "title": "Direction", + "type": "string" + }, + "direction_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Direction ID", + "type": "integer" + }, + "flag_history": { + "title": "Connection Flag History", + "type": "string" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + }, + "protocol_ver": { + "title": "IP Version", + "type": "string" + }, + "protocol_ver_id": { + "enum": [ + 0, + 4, + 6, + 99 + ], + "title": "IP Version ID", + "type": "integer" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "tcp_flags": { + "title": "TCP Flags", + "type": "integer" + }, + "uid": { + "title": "Connection UID", + "type": "string" + } + }, + "required": [ + "direction_id" + ], + "title": "Network Connection Information", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "network_traffic": { + "additionalProperties": false, + "properties": { + "bytes": { + "title": "Total Bytes", + "type": "integer" + }, + "bytes_in": { + "title": "Bytes In", + "type": "integer" + }, + "bytes_missed": { + "title": "Bytes Missed", + "type": "integer" + }, + "bytes_out": { + "title": "Bytes Out", + "type": "integer" + }, + "chunks": { + "title": "Chunks", + "type": "integer" + }, + "chunks_in": { + "title": "Chunks In", + "type": "integer" + }, + "chunks_out": { + "title": "Chunks Out", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "packets": { + "title": "Total Packets", + "type": "integer" + }, + "packets_in": { + "title": "Packets In", + "type": "integer" + }, + "packets_out": { + "title": "Packets Out", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "timespan": { + "$ref": "#/$defs/timespan", + "title": "Time Span" + } + }, + "title": "Network Traffic", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "packet": { + "additionalProperties": false, + "properties": { + "encoding": { + "title": "Encoding", + "type": "string" + }, + "encoding_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Encoding ID", + "type": "integer" + }, + "end_offset": { + "title": "End Offset", + "type": "integer" + }, + "format": { + "title": "Format", + "type": "string" + }, + "format_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Format ID", + "type": "integer" + }, + "sequence_number": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "source_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Source ID", + "type": "integer" + }, + "start_offset": { + "title": "Start Offset", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Packet", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "tls": { + "additionalProperties": false, + "properties": { + "alert": { + "title": "Client TLS Alert", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "certificate_chain": { + "items": { + "type": "string" + }, + "title": "Certificate Chain", + "type": "array" + }, + "cipher": { + "title": "Cipher Suite", + "type": "string" + }, + "client_ciphers": { + "items": { + "type": "string" + }, + "title": "Client Cipher Suites", + "type": "array" + }, + "extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "Extension List", + "type": "array" + }, + "handshake_dur": { + "title": "Handshake Duration", + "type": "integer" + }, + "ja3_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3 Hash" + }, + "ja3s_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3S Hash" + }, + "key_length": { + "title": "Key Length", + "type": "integer" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "server_ciphers": { + "items": { + "type": "string" + }, + "title": "Server Cipher Suites", + "type": "array" + }, + "sni": { + "title": "Server Name Indication", + "type": "string" + }, + "tls_extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "TLS Extension List", + "type": "array" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Transport Layer Security (TLS)", + "type": "object" + }, + "tls_extension": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 5, + 10, + 13, + 14, + 15, + 16, + 18, + 19, + 20, + 21, + 41, + 42, + 43, + 44, + 45, + 47, + 48, + 49, + 50, + 51, + 99 + ], + "title": "Type ID", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "TLS Extension", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/http_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "http_request" + ] + }, + { + "required": [ + "http_response" + ] + } + ], + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_protocol_name": { + "title": "Application Protocol Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 4, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 4002, + "title": "Class ID", + "type": "integer" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Connection Info" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "cumulative_traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Cumulative Traffic" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "http_cookies": { + "items": { + "$ref": "#/$defs/http_cookie" + }, + "title": "HTTP Cookies", + "type": "array" + }, + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" + }, + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "http_status": { + "title": "HTTP Status", + "type": "integer" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "ja4_fingerprint_list": { + "items": { + "$ref": "#/$defs/ja4_fingerprint" + }, + "title": "JA4+ Fingerprints", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "network_observation_point": { + "$ref": "#/$defs/network_endpoint", + "title": "Network Observation Point" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "observation_point": { + "title": "Observation Point", + "type": "string" + }, + "observation_point_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Observation Point ID", + "type": "integer" + }, + "packet_list": { + "items": { + "$ref": "#/$defs/packet" + }, + "title": "Packets", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "proxy": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy" + }, + "proxy_connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Proxy Connection Info" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "proxy_http_request": { + "$ref": "#/$defs/http_request", + "title": "Proxy HTTP Request" + }, + "proxy_http_response": { + "$ref": "#/$defs/http_response", + "title": "Proxy HTTP Response" + }, + "proxy_tls": { + "$ref": "#/$defs/tls", + "title": "Proxy TLS" + }, + "proxy_traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Proxy Traffic" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "tls": { + "$ref": "#/$defs/tls", + "title": "TLS" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Traffic" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "time", + "type_uid" + ], + "title": "HTTP Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/network_activity@container+host+network_proxy+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/network_activity@container+host+network_proxy+security_control+trace.json new file mode 100644 index 0000000000..5803868f12 --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/network_activity@container+host+network_proxy+security_control+trace.json @@ -0,0 +1,8259 @@ +{ + "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for network_activity. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "endpoint_connection": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "code" + ] + }, + { + "required": [ + "network_endpoint" + ] + } + ], + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "network_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Network Endpoint" + } + }, + "title": "Endpoint Connection", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "ja4_fingerprint": { + "additionalProperties": false, + "properties": { + "section_a": { + "title": "JA4 Section A", + "type": "string" + }, + "section_b": { + "title": "JA4 Section B", + "type": "string" + }, + "section_c": { + "title": "JA4 Section C", + "type": "string" + }, + "section_d": { + "title": "JA4 Section D", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "JA4+ Fingerprint", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "load_balancer": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification": { + "title": "Classification", + "type": "string" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "endpoint_connections": { + "items": { + "$ref": "#/$defs/endpoint_connection" + }, + "title": "Endpoint Connections", + "type": "array" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Load Balancer", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_connection_info": { + "additionalProperties": false, + "properties": { + "boundary": { + "title": "Boundary", + "type": "string" + }, + "boundary_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Boundary ID", + "type": "integer" + }, + "community_uid": { + "title": "Community ID", + "type": "string" + }, + "direction": { + "title": "Direction", + "type": "string" + }, + "direction_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Direction ID", + "type": "integer" + }, + "flag_history": { + "title": "Connection Flag History", + "type": "string" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + }, + "protocol_ver": { + "title": "IP Version", + "type": "string" + }, + "protocol_ver_id": { + "enum": [ + 0, + 4, + 6, + 99 + ], + "title": "IP Version ID", + "type": "integer" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "tcp_flags": { + "title": "TCP Flags", + "type": "integer" + }, + "uid": { + "title": "Connection UID", + "type": "string" + } + }, + "required": [ + "direction_id" + ], + "title": "Network Connection Information", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "network_traffic": { + "additionalProperties": false, + "properties": { + "bytes": { + "title": "Total Bytes", + "type": "integer" + }, + "bytes_in": { + "title": "Bytes In", + "type": "integer" + }, + "bytes_missed": { + "title": "Bytes Missed", + "type": "integer" + }, + "bytes_out": { + "title": "Bytes Out", + "type": "integer" + }, + "chunks": { + "title": "Chunks", + "type": "integer" + }, + "chunks_in": { + "title": "Chunks In", + "type": "integer" + }, + "chunks_out": { + "title": "Chunks Out", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "packets": { + "title": "Total Packets", + "type": "integer" + }, + "packets_in": { + "title": "Packets In", + "type": "integer" + }, + "packets_out": { + "title": "Packets Out", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "timespan": { + "$ref": "#/$defs/timespan", + "title": "Time Span" + } + }, + "title": "Network Traffic", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "packet": { + "additionalProperties": false, + "properties": { + "encoding": { + "title": "Encoding", + "type": "string" + }, + "encoding_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Encoding ID", + "type": "integer" + }, + "end_offset": { + "title": "End Offset", + "type": "integer" + }, + "format": { + "title": "Format", + "type": "string" + }, + "format_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Format ID", + "type": "integer" + }, + "sequence_number": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "source_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Source ID", + "type": "integer" + }, + "start_offset": { + "title": "Start Offset", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Packet", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "tls": { + "additionalProperties": false, + "properties": { + "alert": { + "title": "Client TLS Alert", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "certificate_chain": { + "items": { + "type": "string" + }, + "title": "Certificate Chain", + "type": "array" + }, + "cipher": { + "title": "Cipher Suite", + "type": "string" + }, + "client_ciphers": { + "items": { + "type": "string" + }, + "title": "Client Cipher Suites", + "type": "array" + }, + "extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "Extension List", + "type": "array" + }, + "handshake_dur": { + "title": "Handshake Duration", + "type": "integer" + }, + "ja3_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3 Hash" + }, + "ja3s_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3S Hash" + }, + "key_length": { + "title": "Key Length", + "type": "integer" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "server_ciphers": { + "items": { + "type": "string" + }, + "title": "Server Cipher Suites", + "type": "array" + }, + "sni": { + "title": "Server Name Indication", + "type": "string" + }, + "tls_extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "TLS Extension List", + "type": "array" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Transport Layer Security (TLS)", + "type": "object" + }, + "tls_extension": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 5, + 10, + 13, + 14, + 15, + 16, + 18, + 19, + 20, + 21, + 41, + 42, + 43, + 44, + 45, + 47, + 48, + 49, + 50, + 51, + 99 + ], + "title": "Type ID", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "TLS Extension", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/network_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "dst_endpoint" + ] + }, + { + "required": [ + "src_endpoint" + ] + } + ], + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_protocol_name": { + "title": "Application Protocol Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 4, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 4001, + "title": "Class ID", + "type": "integer" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Connection Info" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "cumulative_traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Cumulative Traffic" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "is_src_dst_assignment_known": { + "title": "Source/Destination Assignment Known", + "type": "boolean" + }, + "ja4_fingerprint_list": { + "items": { + "$ref": "#/$defs/ja4_fingerprint" + }, + "title": "JA4+ Fingerprints", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "network_observation_point": { + "$ref": "#/$defs/network_endpoint", + "title": "Network Observation Point" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "observation_point": { + "title": "Observation Point", + "type": "string" + }, + "observation_point_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Observation Point ID", + "type": "integer" + }, + "packet_list": { + "items": { + "$ref": "#/$defs/packet" + }, + "title": "Packets", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "proxy": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy" + }, + "proxy_connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Proxy Connection Info" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "proxy_http_request": { + "$ref": "#/$defs/http_request", + "title": "Proxy HTTP Request" + }, + "proxy_http_response": { + "$ref": "#/$defs/http_response", + "title": "Proxy HTTP Response" + }, + "proxy_tls": { + "$ref": "#/$defs/tls", + "title": "Proxy TLS" + }, + "proxy_traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Proxy Traffic" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "tls": { + "$ref": "#/$defs/tls", + "title": "TLS" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Traffic" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + } + }, + "required": [ + "activity_id", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "time", + "type_uid" + ], + "title": "Network Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/process_activity@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/process_activity@container+host+security_control+trace.json new file mode 100644 index 0000000000..3c12b4a67c --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/process_activity@container+host+security_control+trace.json @@ -0,0 +1,7745 @@ +{ + "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for process_activity. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "ai_model": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "application": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "criticality": { + "title": "Business Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Application Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", + "type": "string" + }, + "uid": { + "title": "Application ID", + "type": "string" + }, + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Application Version", + "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "edge": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "function_invocation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "error" + ] + }, + { + "required": [ + "parameters" + ] + }, + { + "required": [ + "return_value" + ] + } + ], + "properties": { + "error": { + "title": "Error Code", + "type": "string" + }, + "parameters": { + "items": { + "$ref": "#/$defs/parameter" + }, + "title": "Parameters", + "type": "array" + }, + "return_value": { + "title": "Return Value", + "type": "string" + } + }, + "title": "Function Invocation", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "nodes" + ], + "title": "Graph", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] + }, + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", + "type": "string" + }, + "ai_role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "AI Role ID", + "type": "integer" + }, + "application": { + "$ref": "#/$defs/application", + "title": "Application" + }, + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "total_tokens": { + "title": "Total Tokens", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Message Context", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "module": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "function_name" + ] + }, + { + "required": [ + "load_type_id" + ] + } + ], + "properties": { + "base_address": { + "title": "Base Address", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "function_invocation": { + "$ref": "#/$defs/function_invocation", + "title": "Function Invocation" + }, + "function_name": { + "title": "Function Name", + "type": "string" + }, + "load_type": { + "title": "Load Type", + "type": "string" + }, + "load_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Load Type ID", + "type": "integer" + }, + "start_address": { + "title": "Start Address", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "title": "Module", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Node", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "parameter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "post_value" + ] + }, + { + "required": [ + "pre_value" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "post_value": { + "title": "Post-Value", + "type": "string" + }, + "pre_value": { + "title": "Pre-Value", + "type": "string" + } + }, + "title": "Parameter", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/process_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "actual_permissions": { + "title": "Actual Permissions", + "type": "integer" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 1, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 1007, + "title": "Class ID", + "type": "integer" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "exit_code": { + "title": "Exit Code", + "type": "integer" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "injection_type": { + "title": "Injection Type", + "type": "string" + }, + "injection_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Injection Type ID", + "type": "integer" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "launch_type": { + "title": "Launch Type", + "type": "string" + }, + "launch_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Launch Type ID", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "module": { + "$ref": "#/$defs/module", + "title": "Module" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "requested_permissions": { + "title": "Requested Permissions", + "type": "integer" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "actor", + "category_uid", + "class_uid", + "device", + "metadata", + "process", + "severity_id", + "time", + "type_uid" + ], + "title": "Process Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/ssh_activity@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/ssh_activity@container+host+security_control+trace.json new file mode 100644 index 0000000000..9bfd95d12f --- /dev/null +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/ssh_activity@container+host+security_control+trace.json @@ -0,0 +1,8279 @@ +{ + "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for ssh_activity. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", + "$defs": { + "account": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", + "type": "string" + }, + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Advisory", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "analytic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Analytic", + "type": "object" + }, + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "sub_technique" + ] + }, + { + "required": [ + "tactic" + ] + }, + { + "required": [ + "technique" + ] + } + ], + "properties": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" + }, + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "factor_type": { + "title": "Factor Type", + "type": "string" + }, + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" + }, + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "CIS Control", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + }, + "zone": { + "title": "Cloud Availability Zone", + "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { + "items": { + "$ref": "#/$defs/cvss" + }, + "title": "CVSS Score", + "type": "array" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "title": { + "title": "Title", + "type": "string" + }, + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "d3f_tactic" + ] + }, + { + "required": [ + "d3f_technique" + ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" + }, + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "data_classification": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Data Classification", + "type": "object" + }, + "device": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "region": { + "title": "Region", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" + }, + "bios_manufacturer": { + "title": "BIOS Manufacturer", + "type": "string" + }, + "bios_ver": { + "title": "BIOS Version", + "type": "string" + }, + "chassis": { + "title": "Chassis", + "type": "string" + }, + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "CPU Architecture ID", + "type": "integer" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" + }, + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", + "type": "string" + }, + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" + }, + "gpu_count": { + "title": "GPU Count", + "type": "integer" + }, + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" + }, + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" + }, + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Device Hardware Info", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "display": { + "additionalProperties": false, + "properties": { + "color_depth": { + "title": "Color Depth", + "type": "integer" + }, + "physical_height": { + "title": "Physical Height", + "type": "integer" + }, + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" + }, + "physical_width": { + "title": "Physical Width", + "type": "integer" + }, + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "dns_answer": { + "additionalProperties": false, + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" + }, + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" + } + }, + "required": [ + "rdata" + ], + "title": "DNS Answer", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" + }, + "name": { + "title": "Name", + "type": "string" + }, + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "email": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "from" + ] + }, + { + "required": [ + "to" + ] + } + ], + "properties": { + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", + "type": "string" + }, + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", + "type": "string" + }, + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", + "type": "string" + }, + "raw_header": { + "title": "Raw Header", + "type": "string" + }, + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "email_auth": { + "additionalProperties": false, + "properties": { + "dkim": { + "title": "DKIM Status", + "type": "string" + }, + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" + }, + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" + }, + "dmarc": { + "title": "DMARC Status", + "type": "string" + }, + "dmarc_override": { + "title": "DMARC Override", + "type": "string" + }, + "dmarc_policy": { + "title": "DMARC Policy", + "type": "string" + }, + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "endpoint_connection": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "code" + ] + }, + { + "required": [ + "network_endpoint" + ] + } + ], + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "network_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Network Endpoint" + } + }, + "title": "Endpoint Connection", + "type": "object" + }, + "enrichment": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "short_desc": { + "title": "Short Description", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "score" + ], + "title": "EPSS", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Feature", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" + }, + "attributes": { + "title": "Attributes", + "type": "integer" + }, + "company_name": { + "title": "Company Name", + "type": "string" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", + "type": "string" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "ext": { + "title": "File Extension", + "type": "string" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "internal_name": { + "title": "Internal Name", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "is_system": { + "title": "System", + "type": "boolean" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "name": { + "title": "Name", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "parent_folder": { + "title": "Parent Folder", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "security_descriptor": { + "title": "Security Descriptor", + "type": "string" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uri": { + "title": "File URI", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "version": { + "title": "Version", + "type": "string" + }, + "volume": { + "title": "Volume", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "File", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "Group", + "type": "object" + }, + "hassh": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Fingerprint" + } + }, + "required": [ + "fingerprint" + ], + "title": "HASSH", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", + "type": "string" + }, + "length": { + "title": "Request Length", + "type": "integer" + }, + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "http_response": { + "additionalProperties": false, + "properties": { + "body_length": { + "title": "Response Body Length", + "type": "integer" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", + "type": "string" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "latency": { + "title": "Latency", + "type": "integer" + }, + "length": { + "title": "Response Length", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "status": { + "title": "Status", + "type": "string" + } + }, + "required": [ + "code" + ], + "title": "HTTP Response", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" + }, + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "Configuration URL", + "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Image", + "type": "object" + }, + "ja4_fingerprint": { + "additionalProperties": false, + "properties": { + "section_a": { + "title": "JA4 Section A", + "type": "string" + }, + "section_b": { + "title": "JA4 Section B", + "type": "string" + }, + "section_c": { + "title": "JA4 Section C", + "type": "string" + }, + "section_d": { + "title": "JA4 Section D", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "JA4+ Fingerprint", + "type": "object" + }, + "kb_article": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "src_url" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" + }, + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "KB Article", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", + "type": "string" + }, + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", + "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", + "type": "string" + }, + "given_name": { + "title": "Given Name", + "type": "string" + }, + "hire_time": { + "title": "Hire Time", + "type": "integer" + }, + "job_title": { + "title": "Job Title", + "type": "string" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", + "type": "string" + }, + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", + "type": "string" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "surname": { + "title": "Surname", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + } + }, + "title": "LDAP Person", + "type": "object" + }, + "load_balancer": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification": { + "title": "Classification", + "type": "string" + }, + "code": { + "title": "Response Code", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "endpoint_connections": { + "items": { + "$ref": "#/$defs/endpoint_connection" + }, + "title": "Endpoint Connections", + "type": "array" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Load Balancer", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] + }, + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", + "type": "string" + }, + "city": { + "title": "City", + "type": "string" + }, + "continent": { + "title": "Continent", + "type": "string" + }, + "coordinates": { + "items": { + "type": "number" + }, + "title": "Coordinates", + "type": "array" + }, + "country": { + "title": "Country", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "geodetic_altitude": { + "title": "Geodetic Altitude", + "type": "string" + }, + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", + "type": "string" + }, + "geohash": { + "title": "Geohash", + "type": "string" + }, + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" + }, + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "lat": { + "title": "Latitude", + "type": "number" + }, + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", + "type": "string" + }, + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "long_string": { + "additionalProperties": false, + "properties": { + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Long String", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "classification_ids" + ], + "title": "Malware", + "type": "object" + }, + "malware_scan_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { + "items": { + "$ref": "#/$defs/d3fend" + }, + "title": "Countermeasures", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "network_connection_info": { + "additionalProperties": false, + "properties": { + "boundary": { + "title": "Boundary", + "type": "string" + }, + "boundary_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Boundary ID", + "type": "integer" + }, + "community_uid": { + "title": "Community ID", + "type": "string" + }, + "direction": { + "title": "Direction", + "type": "string" + }, + "direction_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Direction ID", + "type": "integer" + }, + "flag_history": { + "title": "Connection Flag History", + "type": "string" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + }, + "protocol_ver": { + "title": "IP Version", + "type": "string" + }, + "protocol_ver_id": { + "enum": [ + 0, + 4, + 6, + 99 + ], + "title": "IP Version ID", + "type": "integer" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "tcp_flags": { + "title": "TCP Flags", + "type": "integer" + }, + "uid": { + "title": "Connection UID", + "type": "string" + } + }, + "required": [ + "direction_id" + ], + "title": "Network Connection Information", + "type": "object" + }, + "network_endpoint": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "mac" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "network_proxy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Network Proxy Endpoint", + "type": "object" + }, + "network_traffic": { + "additionalProperties": false, + "properties": { + "bytes": { + "title": "Total Bytes", + "type": "integer" + }, + "bytes_in": { + "title": "Bytes In", + "type": "integer" + }, + "bytes_missed": { + "title": "Bytes Missed", + "type": "integer" + }, + "bytes_out": { + "title": "Bytes Out", + "type": "integer" + }, + "chunks": { + "title": "Chunks", + "type": "integer" + }, + "chunks_in": { + "title": "Chunks In", + "type": "integer" + }, + "chunks_out": { + "title": "Chunks Out", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "packets": { + "title": "Total Packets", + "type": "integer" + }, + "packets_in": { + "title": "Packets In", + "type": "integer" + }, + "packets_out": { + "title": "Packets Out", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "timespan": { + "$ref": "#/$defs/timespan", + "title": "Time Span" + } + }, + "title": "Network Traffic", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "occurrence_details": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], + "properties": { + "cell_name": { + "title": "Cell Name", + "type": "string" + }, + "column_name": { + "title": "Column Name", + "type": "string" + }, + "column_number": { + "title": "Column Number", + "type": "integer" + }, + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", + "type": "string" + }, + "page_number": { + "title": "Page Number", + "type": "integer" + }, + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" + }, + "row_number": { + "title": "Row Number", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "os": { + "additionalProperties": false, + "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "sp_name": { + "title": "OS Service Pack", + "type": "string" + }, + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "category": { + "title": "Category", + "type": "string" + }, + "comment": { + "title": "Analyst Comments", + "type": "string" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type": { + "title": "Detection Pattern", + "type": "string" + }, + "detection_pattern_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Detection Pattern Type ID", + "type": "integer" + }, + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "external_uid": { + "title": "External ID", + "type": "string" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "subnet": { + "title": "Related Subnet", + "type": "string" + }, + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 99 + ], + "title": "Indicator Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "value": { + "title": "Indicator", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "packet": { + "additionalProperties": false, + "properties": { + "encoding": { + "title": "Encoding", + "type": "string" + }, + "encoding_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Encoding ID", + "type": "integer" + }, + "end_offset": { + "title": "End Offset", + "type": "integer" + }, + "format": { + "title": "Format", + "type": "string" + }, + "format_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Format ID", + "type": "integer" + }, + "sequence_number": { + "title": "Sequence Number", + "type": "integer" + }, + "source": { + "title": "Source", + "type": "string" + }, + "source_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Source ID", + "type": "integer" + }, + "start_offset": { + "title": "Start Offset", + "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "value" + ], + "title": "Packet", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "type" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "is_applied": { + "title": "Applied", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "process": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" + }, + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Integrity Level", + "type": "integer" + }, + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" + }, + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "ptid": { + "title": "Process Thread ID", + "type": "integer" + }, + "sandbox": { + "title": "Sandbox", + "type": "string" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "terminated_time": { + "title": "Terminated Time", + "type": "integer" + }, + "tid": { + "title": "Thread ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", + "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" + } + }, + "title": "Process", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "pid": { + "title": "Process ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "product": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Programmatic Credential", + "type": "object" + }, + "remediation": { + "additionalProperties": false, + "properties": { + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + } + }, + "required": [ + "desc" + ], + "title": "Remediation", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" + }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", + "type": "string" + }, + "error_message": { + "title": "Error Message", + "type": "string" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + } + }, + "required": [ + "name", + "type" + ], + "title": "Subject Alternative Name", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", + "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "message": { + "title": "Message", + "type": "string" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "end_time", + "start_time", + "uid" + ], + "title": "Span", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "duration_mins": { + "title": "SSO Session Duration", + "type": "integer" + }, + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" + }, + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" + }, + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "scopes": { + "items": { + "type": "string" + }, + "title": "Scopes", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Tactic", + "type": "object" + }, + "technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "timespan": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "tls": { + "additionalProperties": false, + "properties": { + "alert": { + "title": "Client TLS Alert", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "certificate_chain": { + "items": { + "type": "string" + }, + "title": "Certificate Chain", + "type": "array" + }, + "cipher": { + "title": "Cipher Suite", + "type": "string" + }, + "client_ciphers": { + "items": { + "type": "string" + }, + "title": "Client Cipher Suites", + "type": "array" + }, + "extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "Extension List", + "type": "array" + }, + "handshake_dur": { + "title": "Handshake Duration", + "type": "integer" + }, + "ja3_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3 Hash" + }, + "ja3s_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3S Hash" + }, + "key_length": { + "title": "Key Length", + "type": "integer" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "server_ciphers": { + "items": { + "type": "string" + }, + "title": "Server Cipher Suites", + "type": "array" + }, + "sni": { + "title": "Server Name Indication", + "type": "string" + }, + "tls_extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "TLS Extension List", + "type": "array" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Transport Layer Security (TLS)", + "type": "object" + }, + "tls_extension": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 5, + 10, + 13, + 14, + 15, + 16, + 18, + 19, + 20, + 21, + 41, + 42, + 43, + 44, + 45, + 47, + 48, + 49, + 50, + 51, + 99 + ], + "title": "Type ID", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "TLS Extension", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + } + }, + "title": "Token", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Trace", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", + "type": "string" + }, + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", + "type": "string" + }, + "display_name": { + "title": "Display Name", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, + "name": { + "title": "Name", + "type": "string" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", + "type": "string" + }, + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "vulnerability": { + "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], + "properties": { + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", + "type": "string" + }, + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" + }, + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" + }, + "exploit_ref_url": { + "title": "Exploit URL", + "type": "string" + }, + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" + }, + "exploit_type": { + "title": "Exploit Type", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Fix Coverage ID", + "type": "integer" + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "win_win_service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "service_category": { + "title": "Service Category", + "type": "string" + }, + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", + "type": "string" + }, + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", + "type": "string" + }, + "service_start_type": { + "title": "Service Start Type", + "type": "string" + }, + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + } + }, + "$id": "https://schema.ocsf.io/schema/classes/ssh_activity", + "$schema": "http://json-schema.org/draft-07/schema#", + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "dst_endpoint" + ] + }, + { + "required": [ + "src_endpoint" + ] + } + ], + "properties": { + "action": { + "title": "Action", + "type": "string" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", + "type": "string" + }, + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_protocol_name": { + "title": "Application Protocol Name", + "type": "string" + }, + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "auth_type": { + "title": "Authentication Type", + "type": "string" + }, + "auth_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Authentication Type ID", + "type": "integer" + }, + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" + }, + "category_name": { + "title": "Category", + "type": "string" + }, + "category_uid": { + "const": 4, + "title": "Category ID", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "class_uid": { + "const": 4007, + "title": "Class ID", + "type": "integer" + }, + "client_hassh": { + "$ref": "#/$defs/hassh", + "title": "Client HASSH" + }, + "confidence": { + "title": "Confidence", + "type": "string" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" + }, + "confidence_score": { + "title": "Confidence Score", + "type": "integer" + }, + "connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Connection Info" + }, + "count": { + "title": "Count", + "type": "integer" + }, + "cumulative_traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Cumulative Traffic" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "disposition": { + "title": "Disposition", + "type": "string" + }, + "disposition_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 99 + ], + "title": "Disposition ID", + "type": "integer" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "ja4_fingerprint_list": { + "items": { + "$ref": "#/$defs/ja4_fingerprint" + }, + "title": "JA4+ Fingerprints", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "message": { + "title": "Message", + "type": "string" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "network_observation_point": { + "$ref": "#/$defs/network_endpoint", + "title": "Network Observation Point" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, + "observation_point": { + "title": "Observation Point", + "type": "string" + }, + "observation_point_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Observation Point ID", + "type": "integer" + }, + "packet_list": { + "items": { + "$ref": "#/$defs/packet" + }, + "title": "Packets", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "protocol_ver": { + "title": "SSH Version", + "type": "string" + }, + "proxy": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "server_hassh": { + "$ref": "#/$defs/hassh", + "title": "Server HASSH" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "status": { + "title": "Status", + "type": "string" + }, + "status_code": { + "title": "Status Code", + "type": "string" + }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "tls": { + "$ref": "#/$defs/tls", + "title": "TLS" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Traffic" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "type_uid": { + "title": "Type ID", + "type": "integer" + }, + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + } + }, + "required": [ + "activity_id", + "category_uid", + "class_uid", + "metadata", + "severity_id", + "time", + "type_uid" + ], + "title": "SSH Activity", + "type": "object" +} diff --git a/crates/openshell-ocsf/src/builders/api_activity.rs b/crates/openshell-ocsf/src/builders/api_activity.rs index 480ca575dd..d238364110 100644 --- a/crates/openshell-ocsf/src/builders/api_activity.rs +++ b/crates/openshell-ocsf/src/builders/api_activity.rs @@ -29,6 +29,7 @@ fn sanitize_model_name(name: &str) -> String { /// Builder for API Activity [6003] events. pub struct ApiActivityBuilder<'a> { ctx: ContextRef<'a>, + trace: Option, severity: SeverityId, status: Option, message: Option, @@ -48,10 +49,18 @@ pub struct ApiActivityBuilder<'a> { } impl<'a> ApiActivityBuilder<'a> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + #[must_use] pub fn new(ctx: impl Into>, operation: impl Into) -> Self { Self { ctx: ctx.into(), + trace: None, severity: SeverityId::Informational, status: None, message: None, @@ -201,6 +210,10 @@ impl<'a> ApiActivityBuilder<'a> { self.ctx .apply_common_fields(&mut base, self.status, self.message); + if let Some(trace) = self.trace { + base.set_trace(trace); + } + OcsfEvent::ApiActivity(ApiActivityEvent { base, api: Api { diff --git a/crates/openshell-ocsf/src/builders/authentication.rs b/crates/openshell-ocsf/src/builders/authentication.rs index e901d5134c..7b412a49ed 100644 --- a/crates/openshell-ocsf/src/builders/authentication.rs +++ b/crates/openshell-ocsf/src/builders/authentication.rs @@ -12,6 +12,7 @@ use crate::objects::{Endpoint, HttpRequest, Service, User}; /// Builder for Authentication [3002] Logon events. pub struct AuthenticationBuilder<'a> { ctx: ContextRef<'a>, + trace: Option, user: User, service: Service, auth_protocol: Option, @@ -28,10 +29,18 @@ pub struct AuthenticationBuilder<'a> { } impl<'a> AuthenticationBuilder<'a> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + #[must_use] pub fn new(ctx: impl Into>, user: User, service: Service) -> Self { Self { ctx: ctx.into(), + trace: None, user, service, auth_protocol: None, @@ -113,6 +122,9 @@ impl<'a> AuthenticationBuilder<'a> { if let Some(device) = base.device.as_mut() { device.container = None; } + if let Some(trace) = self.trace { + base.set_trace(trace); + } OcsfEvent::Authentication(AuthenticationEvent { base, diff --git a/crates/openshell-ocsf/src/builders/base.rs b/crates/openshell-ocsf/src/builders/base.rs index c08f1aa0aa..5243caac7a 100644 --- a/crates/openshell-ocsf/src/builders/base.rs +++ b/crates/openshell-ocsf/src/builders/base.rs @@ -11,6 +11,7 @@ use crate::events::{BaseEvent, OcsfEvent}; /// Builder for Base Event [0] — events without a specific OCSF class. pub struct BaseEventBuilder<'a> { ctx: ContextRef<'a>, + trace: Option, severity: SeverityId, status: Option, message: Option, @@ -19,10 +20,18 @@ pub struct BaseEventBuilder<'a> { } impl<'a> BaseEventBuilder<'a> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + #[must_use] pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), + trace: None, severity: SeverityId::Informational, status: None, message: None, @@ -63,6 +72,10 @@ impl<'a> BaseEventBuilder<'a> { self.ctx .apply_common_fields(&mut base, self.status, self.message); + if let Some(trace) = self.trace { + base.set_trace(trace); + } + OcsfEvent::Base(BaseEvent { base }) } } diff --git a/crates/openshell-ocsf/src/builders/config.rs b/crates/openshell-ocsf/src/builders/config.rs index 906470408d..25e229d04e 100644 --- a/crates/openshell-ocsf/src/builders/config.rs +++ b/crates/openshell-ocsf/src/builders/config.rs @@ -11,6 +11,7 @@ use crate::events::{DeviceConfigStateChangeEvent, OcsfEvent}; /// Builder for Device Config State Change [5019] events. pub struct ConfigStateChangeBuilder<'a> { ctx: ContextRef<'a>, + trace: Option, severity: SeverityId, status: Option, state_id: Option, @@ -22,10 +23,18 @@ pub struct ConfigStateChangeBuilder<'a> { } impl<'a> ConfigStateChangeBuilder<'a> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + #[must_use] pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), + trace: None, severity: SeverityId::Informational, status: None, state_id: None, @@ -82,6 +91,10 @@ impl<'a> ConfigStateChangeBuilder<'a> { self.ctx .apply_common_fields(&mut base, self.status, self.message); + if let Some(trace) = self.trace { + base.set_trace(trace); + } + OcsfEvent::DeviceConfigStateChange(DeviceConfigStateChangeEvent { base, state: self.state_id, diff --git a/crates/openshell-ocsf/src/builders/finding.rs b/crates/openshell-ocsf/src/builders/finding.rs index fe66c4c796..b4152549c0 100644 --- a/crates/openshell-ocsf/src/builders/finding.rs +++ b/crates/openshell-ocsf/src/builders/finding.rs @@ -12,6 +12,7 @@ use crate::objects::{Attack, Evidence, FindingInfo, Remediation}; /// Builder for Detection Finding [2004] events. pub struct DetectionFindingBuilder<'a> { ctx: ContextRef<'a>, + trace: Option, activity: ActivityId, severity: SeverityId, action: Option, @@ -30,10 +31,18 @@ pub struct DetectionFindingBuilder<'a> { } impl<'a> DetectionFindingBuilder<'a> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + #[must_use] pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), + trace: None, activity: ActivityId::Open, severity: SeverityId::Medium, action: None, @@ -149,6 +158,10 @@ impl<'a> DetectionFindingBuilder<'a> { } self.ctx.apply_common_fields(&mut base, None, self.message); + if let Some(trace) = self.trace { + base.set_trace(trace); + } + OcsfEvent::DetectionFinding(DetectionFindingEvent { base, finding_info: self diff --git a/crates/openshell-ocsf/src/builders/http.rs b/crates/openshell-ocsf/src/builders/http.rs index e2f85bdab2..2738785c20 100644 --- a/crates/openshell-ocsf/src/builders/http.rs +++ b/crates/openshell-ocsf/src/builders/http.rs @@ -12,6 +12,7 @@ use crate::objects::{Actor, Endpoint, FirewallRule, HttpRequest, HttpResponse}; /// Builder for HTTP Activity [4002] events. pub struct HttpActivityBuilder<'a, Context = MissingHttpContext> { ctx: ContextRef<'a>, + trace: Option, activity: ActivityId, action: Option, disposition: Option, @@ -50,6 +51,7 @@ impl<'a> HttpActivityBuilder<'a, MissingHttpContext> { pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), + trace: None, activity: ActivityId::Unknown, action: None, disposition: None, @@ -94,9 +96,17 @@ impl HttpActivityBuilder<'_, HasHttpContext> { } impl<'a, Context> HttpActivityBuilder<'a, Context> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + fn with_http_request(self, req: HttpRequest) -> HttpActivityBuilder<'a, HasHttpContext> { HttpActivityBuilder { ctx: self.ctx, + trace: self.trace, activity: self.activity, action: self.action, disposition: self.disposition, @@ -118,6 +128,7 @@ impl<'a, Context> HttpActivityBuilder<'a, Context> { fn with_http_response(self, resp: HttpResponse) -> HttpActivityBuilder<'a, HasHttpContext> { HttpActivityBuilder { ctx: self.ctx, + trace: self.trace, activity: self.activity, action: self.action, disposition: self.disposition, @@ -201,6 +212,10 @@ impl HttpActivityBuilder<'_, HasHttpContext> { self.ctx .apply_common_fields(&mut base, self.status, self.message); + if let Some(trace) = self.trace { + base.set_trace(trace); + } + OcsfEvent::HttpActivity(HttpActivityEvent { base, http_request: self.http_request, diff --git a/crates/openshell-ocsf/src/builders/lifecycle.rs b/crates/openshell-ocsf/src/builders/lifecycle.rs index b425b3e79b..f0a2357179 100644 --- a/crates/openshell-ocsf/src/builders/lifecycle.rs +++ b/crates/openshell-ocsf/src/builders/lifecycle.rs @@ -12,6 +12,7 @@ use crate::objects::Product; /// Builder for Application Lifecycle [6002] events. pub struct AppLifecycleBuilder<'a> { ctx: ContextRef<'a>, + trace: Option, activity: ActivityId, severity: SeverityId, status: Option, @@ -19,10 +20,18 @@ pub struct AppLifecycleBuilder<'a> { } impl<'a> AppLifecycleBuilder<'a> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + #[must_use] pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), + trace: None, activity: ActivityId::Unknown, severity: SeverityId::Informational, status: None, @@ -46,6 +55,10 @@ impl<'a> AppLifecycleBuilder<'a> { self.ctx .apply_common_fields(&mut base, self.status, self.message); + if let Some(trace) = self.trace { + base.set_trace(trace); + } + OcsfEvent::ApplicationLifecycle(ApplicationLifecycleEvent { base, app: Product::openshell_sandbox(&self.ctx.product_version), diff --git a/crates/openshell-ocsf/src/builders/network.rs b/crates/openshell-ocsf/src/builders/network.rs index 950cc7e1c8..81b0293475 100644 --- a/crates/openshell-ocsf/src/builders/network.rs +++ b/crates/openshell-ocsf/src/builders/network.rs @@ -12,6 +12,7 @@ use crate::objects::{Actor, ConnectionInfo, Endpoint, FirewallRule}; /// Builder for Network Activity [4001] events. pub struct NetworkActivityBuilder<'a, EndpointState = MissingNetworkEndpoint> { ctx: ContextRef<'a>, + trace: Option, activity: ActivityId, activity_name: Option, action: Option, @@ -52,6 +53,7 @@ impl<'a> NetworkActivityBuilder<'a, MissingNetworkEndpoint> { pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), + trace: None, activity: ActivityId::Unknown, activity_name: None, action: None, @@ -105,12 +107,20 @@ impl NetworkActivityBuilder<'_, HasNetworkEndpoint> { } impl<'a, EndpointState> NetworkActivityBuilder<'a, EndpointState> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + fn with_src_endpoint( self, endpoint: Endpoint, ) -> NetworkActivityBuilder<'a, HasNetworkEndpoint> { NetworkActivityBuilder { ctx: self.ctx, + trace: self.trace, activity: self.activity, activity_name: self.activity_name, action: self.action, @@ -137,6 +147,7 @@ impl<'a, EndpointState> NetworkActivityBuilder<'a, EndpointState> { ) -> NetworkActivityBuilder<'a, HasNetworkEndpoint> { NetworkActivityBuilder { ctx: self.ctx, + trace: self.trace, activity: self.activity, activity_name: self.activity_name, action: self.action, @@ -243,6 +254,10 @@ impl NetworkActivityBuilder<'_, HasNetworkEndpoint> { self.ctx .apply_common_fields(&mut base, self.status, self.message); + if let Some(trace) = self.trace { + base.set_trace(trace); + } + OcsfEvent::NetworkActivity(NetworkActivityEvent { base, src_endpoint: self.src_endpoint, diff --git a/crates/openshell-ocsf/src/builders/process.rs b/crates/openshell-ocsf/src/builders/process.rs index ae6a6dfe14..087d4f401a 100644 --- a/crates/openshell-ocsf/src/builders/process.rs +++ b/crates/openshell-ocsf/src/builders/process.rs @@ -12,6 +12,7 @@ use crate::objects::{Actor, Process}; /// Builder for Process Activity [1007] events. pub struct ProcessActivityBuilder<'a, ActorState = MissingActor> { ctx: ContextRef<'a>, + trace: Option, activity: ActivityId, severity: SeverityId, status: Option, @@ -45,6 +46,7 @@ impl<'a> ProcessActivityBuilder<'a, MissingActor> { pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), + trace: None, activity: ActivityId::Unknown, severity: SeverityId::Informational, status: None, @@ -64,6 +66,7 @@ impl<'a> ProcessActivityBuilder<'a, MissingActor> { pub fn actor_process(self, process: Process) -> ProcessActivityBuilder<'a, HasActor> { ProcessActivityBuilder { ctx: self.ctx, + trace: self.trace, activity: self.activity, severity: self.severity, status: self.status, @@ -80,6 +83,13 @@ impl<'a> ProcessActivityBuilder<'a, MissingActor> { } impl ProcessActivityBuilder<'_, ActorState> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + /// Set the action taken. /// Set the disposition of the action. /// Set the event severity. @@ -124,6 +134,10 @@ impl ProcessActivityBuilder<'_, HasActor> { self.ctx .apply_common_fields(&mut base, self.status, self.message); + if let Some(trace) = self.trace { + base.set_trace(trace); + } + OcsfEvent::ProcessActivity(ProcessActivityEvent { base, process: self.process.unwrap_or_else(|| Process::new("unknown", 0)), diff --git a/crates/openshell-ocsf/src/builders/ssh.rs b/crates/openshell-ocsf/src/builders/ssh.rs index 21fdfa0153..3153948398 100644 --- a/crates/openshell-ocsf/src/builders/ssh.rs +++ b/crates/openshell-ocsf/src/builders/ssh.rs @@ -12,6 +12,7 @@ use crate::objects::{Actor, Endpoint}; /// Builder for SSH Activity [4007] events. pub struct SshActivityBuilder<'a, EndpointState = MissingSshEndpoint> { ctx: ContextRef<'a>, + trace: Option, activity: ActivityId, action: Option, disposition: Option, @@ -48,6 +49,7 @@ impl<'a> SshActivityBuilder<'a, MissingSshEndpoint> { pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), + trace: None, activity: ActivityId::Unknown, action: None, disposition: None, @@ -66,6 +68,13 @@ impl<'a> SshActivityBuilder<'a, MissingSshEndpoint> { } impl<'a, EndpointState> SshActivityBuilder<'a, EndpointState> { + /// Set trace correlation explicitly instead of using the active span. + #[must_use] + pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { + self.trace = Some(trace); + self + } + /// Set the source endpoint from an address. #[must_use] pub fn src_endpoint_addr( @@ -87,6 +96,7 @@ impl<'a, EndpointState> SshActivityBuilder<'a, EndpointState> { fn with_endpoint(self) -> SshActivityBuilder<'a, HasSshEndpoint> { SshActivityBuilder { ctx: self.ctx, + trace: self.trace, activity: self.activity, action: self.action, disposition: self.disposition, @@ -147,6 +157,10 @@ impl SshActivityBuilder<'_, HasSshEndpoint> { self.ctx .apply_common_fields(&mut base, self.status, self.message); + if let Some(trace) = self.trace { + base.set_trace(trace); + } + OcsfEvent::SshActivity(SshActivityEvent { base, src_endpoint: self.src_endpoint, diff --git a/crates/openshell-ocsf/src/events/base_event.rs b/crates/openshell-ocsf/src/events/base_event.rs index e023516de5..a0a6f1b9d5 100644 --- a/crates/openshell-ocsf/src/events/base_event.rs +++ b/crates/openshell-ocsf/src/events/base_event.rs @@ -13,6 +13,10 @@ use crate::objects::{AiModel, Device, Metadata}; /// Every event class embeds this struct via `#[serde(flatten)]`. #[derive(Debug, Clone, PartialEq, Eq, Deserialize)] pub struct BaseEventData { + /// Optional trace correlation from the OCSF producer (Trace profile). + #[serde(default, skip_serializing_if = "Option::is_none")] + pub trace: Option, + /// OCSF class UID (e.g., 4001 for Network Activity). pub class_uid: u32, @@ -76,7 +80,6 @@ impl Serialize for BaseEventData { fn serialize(&self, serializer: S) -> Result { use serde::ser::SerializeMap; - // Count fields: 9 required + severity pair (2) + up to 6 optional let mut map = serializer.serialize_map(None)?; map.serialize_entry("class_uid", &self.class_uid)?; @@ -112,6 +115,9 @@ impl Serialize for BaseEventData { if let Some(ref ai_model) = self.ai_model { map.serialize_entry("ai_model", ai_model)?; } + if let Some(ref trace) = self.trace { + map.serialize_entry("trace", trace)?; + } if let Some(ref unmapped) = self.unmapped { map.serialize_entry("unmapped", unmapped)?; } @@ -154,6 +160,7 @@ impl BaseEventData { metadata, device: None, ai_model: None, + trace: None, unmapped: None, } } @@ -188,6 +195,19 @@ impl BaseEventData { self.ai_model = Some(ai_model); } + /// Set explicit trace correlation and add the Trace profile once. + pub fn set_trace(&mut self, trace: crate::TraceCorrelation) { + self.trace = Some(trace); + if !self + .metadata + .profiles + .iter() + .any(|profile| profile == "trace") + { + self.metadata.profiles.push("trace".to_string()); + } + } + /// Add an unmapped field. pub fn add_unmapped(&mut self, key: &str, value: impl Into) { let map = self diff --git a/crates/openshell-ocsf/src/events/mod.rs b/crates/openshell-ocsf/src/events/mod.rs index e57a870f54..66038cd9cb 100644 --- a/crates/openshell-ocsf/src/events/mod.rs +++ b/crates/openshell-ocsf/src/events/mod.rs @@ -168,6 +168,22 @@ impl OcsfEvent { Self::Base(e) => &e.base, } } + + /// Returns mutable base data common to all event classes. + pub(crate) fn base_mut(&mut self) -> &mut BaseEventData { + match self { + Self::NetworkActivity(e) => &mut e.base, + Self::HttpActivity(e) => &mut e.base, + Self::SshActivity(e) => &mut e.base, + Self::ProcessActivity(e) => &mut e.base, + Self::Authentication(e) => &mut e.base, + Self::DetectionFinding(e) => &mut e.base, + Self::ApplicationLifecycle(e) => &mut e.base, + Self::DeviceConfigStateChange(e) => &mut e.base, + Self::ApiActivity(e) => &mut e.base, + Self::Base(e) => &mut e.base, + } + } } #[cfg(test)] diff --git a/crates/openshell-ocsf/src/lib.rs b/crates/openshell-ocsf/src/lib.rs index 661b4c6f5a..4b169e165c 100644 --- a/crates/openshell-ocsf/src/lib.rs +++ b/crates/openshell-ocsf/src/lib.rs @@ -31,6 +31,9 @@ pub mod events; pub mod format; pub mod objects; pub mod sanitize; +mod trace; + +pub use trace::{TraceCorrelation, register_trace_correlation_extractor}; pub mod tracing_layers; #[cfg(any(test, feature = "test-support"))] diff --git a/crates/openshell-ocsf/src/trace.rs b/crates/openshell-ocsf/src/trace.rs new file mode 100644 index 0000000000..94c82763c3 --- /dev/null +++ b/crates/openshell-ocsf/src/trace.rs @@ -0,0 +1,239 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +//! OCSF trace correlation and optional enrichment at emission. + +use std::sync::OnceLock; + +use serde::{Deserialize, Serialize}; + +/// Trace ID supplied by an OCSF producer. +/// +/// The registered extractor returns valid, sampled context from the active +/// span. Gateway context may inherit a caller's traceparent, including before +/// authentication: this value is a correlation hint, not an identity assertion. +/// Explicit callers are responsible for validating their trace IDs. +#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +pub struct TraceCorrelation { + /// W3C trace ID: 32 lowercase hexadecimal characters. + pub uid: String, +} + +static EXTRACTOR: OnceLock Option> = OnceLock::new(); + +/// Register the process-wide trace extractor at startup. +/// +/// Returns `false` if an extractor is already registered. Without an extractor, +/// events receive only explicitly supplied correlation. +pub fn register_trace_correlation_extractor(extractor: fn() -> Option) -> bool { + EXTRACTOR.set(extractor).is_ok() +} + +pub fn enrich(event: &mut crate::OcsfEvent) { + if event.base().trace.is_none() + && let Some(trace) = EXTRACTOR.get().and_then(|extract| extract()) + { + event.base_mut().set_trace(trace); + } +} + +#[cfg(test)] +mod tests { + use crate::*; + use openshell_ocsf_validate::validate_event; + + #[test] + fn all_builders_preserve_explicit_trace_through_typestate_and_roundtrip() { + let ctx = builders::test_sandbox_context(); + let trace = TraceCorrelation { + uid: "0af7651916cd43dd8448eb211c80319c".to_string(), + }; + for context in [ + ContextRef::from(&ctx), + ContextRef::from(std::sync::Arc::new(ctx.clone())), + ] { + let events = [ + NetworkActivityBuilder::new(context.clone()) + .trace(trace.clone()) + .dst_endpoint(Endpoint::from_domain("example.com", 443)) + .build(), + HttpActivityBuilder::new(context.clone()) + .trace(trace.clone()) + .http_request(HttpRequest::new( + "GET", + Url::new("https", "example.com", "/", 443), + )) + .build(), + BaseEventBuilder::new(context.clone()) + .trace(trace.clone()) + .build(), + AppLifecycleBuilder::new(context.clone()) + .trace(trace.clone()) + .build(), + ConfigStateChangeBuilder::new(context.clone()) + .trace(trace.clone()) + .build(), + DetectionFindingBuilder::new(context.clone()) + .trace(trace.clone()) + .build(), + ProcessActivityBuilder::new(context.clone()) + .trace(trace.clone()) + .actor_process(Process::new("openshell-sandbox", 1)) + .process(Process::new("workload", 2)) + .build(), + SshActivityBuilder::new(context.clone()) + .trace(trace.clone()) + .dst_endpoint(Endpoint::from_ip("192.0.2.1".parse().unwrap(), 22)) + .build(), + AuthenticationBuilder::new( + context.clone(), + User::unidentified(), + Service::new("openshell-gateway"), + ) + .trace(trace.clone()) + .build(), + ApiActivityBuilder::new(context, "GET /") + .trace(trace.clone()) + .build(), + ]; + for event in events { + let value = event.to_json().unwrap(); + assert_eq!(value["device"]["hostname"], ctx.hostname); + if value["class_uid"] == 3002 { + // Authentication's schema does not allow the container profile. + assert!(value.get("container").is_none()); + } else { + assert_eq!(value["container"]["uid"], ctx.sandbox_id); + assert_eq!(value["container"]["name"], ctx.sandbox_name); + } + validate_event(&value).unwrap_or_else(|e| panic!("{e}")); + assert_eq!(value["trace"]["uid"], trace.uid); + assert_eq!(value["trace"].as_object().unwrap().len(), 1); + let decoded: OcsfEvent = serde_json::from_value(value.clone()).unwrap(); + assert_eq!(decoded.to_json().unwrap(), value); + assert_eq!( + value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .filter(|p| *p == "trace") + .count(), + 1 + ); + let mut plain = value; + plain.as_object_mut().unwrap().remove("trace"); + plain["metadata"]["profiles"] + .as_array_mut() + .unwrap() + .retain(|name| name != "trace"); + validate_event(&plain).unwrap_or_else(|e| panic!("{e}")); + } + } + } + + #[test] + fn production_event_shapes_validate_with_and_without_trace() { + let trace = TraceCorrelation { + uid: "0af7651916cd43dd8448eb211c80319c".to_string(), + }; + for ctx in [ + builders::test_sandbox_context(), + builders::test_gateway_context(), + ] { + for (class, mut event) in builders::sample_events(&ctx) { + let plain = event.to_json().unwrap(); + validate_event(&plain).unwrap_or_else(|e| panic!("{class} without trace: {e}")); + event.base_mut().set_trace(trace.clone()); + let correlated = event.to_json().unwrap(); + validate_event(&correlated).unwrap_or_else(|e| panic!("{class} with trace: {e}")); + } + } + } + + #[test] + fn required_typestate_transitions_allow_replacing_explicit_trace() { + let ctx = builders::test_sandbox_context(); + let initial = TraceCorrelation { + uid: "0af7651916cd43dd8448eb211c80319c".to_string(), + }; + let replacement = TraceCorrelation { + uid: "4bf92f3577b34da6a3ce929d0e0e4736".to_string(), + }; + let events = [ + ProcessActivityBuilder::new(&ctx) + .trace(initial.clone()) + .actor_process(Process::new("openshell-sandbox", 1)) + .trace(replacement.clone()) + .build(), + SshActivityBuilder::new(&ctx) + .trace(initial.clone()) + .src_endpoint_addr("192.0.2.1".parse().unwrap(), 22) + .trace(replacement.clone()) + .dst_endpoint(Endpoint::from_domain("sandbox.local", 22)) + .build(), + SshActivityBuilder::new(&ctx) + .trace(initial) + .dst_endpoint(Endpoint::from_domain("sandbox.local", 22)) + .trace(replacement.clone()) + .src_endpoint_addr("192.0.2.1".parse().unwrap(), 22) + .build(), + ]; + for event in events { + let value = event.to_json().unwrap(); + assert_eq!(value["trace"]["uid"], replacement.uid); + validate_event(&value).unwrap_or_else(|e| panic!("{e}")); + } + } + + #[test] + fn exported_schema_checks_trace_shape_and_declared_profile() { + let ctx = builders::test_sandbox_context(); + let mut value = BaseEventBuilder::new(&ctx) + .trace(TraceCorrelation { + uid: "0af7651916cd43dd8448eb211c80319c".to_string(), + }) + .build() + .to_json() + .unwrap(); + validate_event(&value).unwrap_or_else(|e| panic!("{e}")); + value["trace"]["uid"] = serde_json::json!(42); + assert!(matches!( + validate_event(&value), + Err(openshell_ocsf_validate::Error::Invalid(_)) + )); + value["trace"] = serde_json::json!({}); + assert!(matches!( + validate_event(&value), + Err(openshell_ocsf_validate::Error::Invalid(_)) + )); + value["trace"] = + serde_json::json!({"uid": "0af7651916cd43dd8448eb211c80319c", "bogus": true}); + assert!(matches!( + validate_event(&value), + Err(openshell_ocsf_validate::Error::Invalid(_)) + )); + value["trace"].as_object_mut().unwrap().remove("bogus"); + value["metadata"]["profiles"] + .as_array_mut() + .unwrap() + .retain(|name| name != "trace"); + assert!(matches!( + validate_event(&value), + Err(openshell_ocsf_validate::Error::Invalid(_)) + )); + } + + #[test] + fn plain_event_omits_trace_profile_and_object() { + let ctx = builders::test_sandbox_context(); + let value = BaseEventBuilder::new(&ctx).build().to_json().unwrap(); + assert!(value.get("trace").is_none()); + assert!( + !value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|p| p == "trace") + ); + } +} diff --git a/crates/openshell-ocsf/src/tracing_layers/event_bridge.rs b/crates/openshell-ocsf/src/tracing_layers/event_bridge.rs index c4a5ccb895..ca5a5e9cdd 100644 --- a/crates/openshell-ocsf/src/tracing_layers/event_bridge.rs +++ b/crates/openshell-ocsf/src/tracing_layers/event_bridge.rs @@ -34,7 +34,8 @@ pub fn clone_current_event() -> Option { /// as human-readable shorthand and structured JSONL for their configured sinks. /// /// Both layers receive the event — `clone_current_event()` is non-consuming. -pub fn emit_ocsf_event(event: OcsfEvent) { +pub fn emit_ocsf_event(mut event: OcsfEvent) { + crate::trace::enrich(&mut event); // Store the event in thread-local so layers can access it set_current_event(event); @@ -81,7 +82,8 @@ pub fn clear_current_event() { /// bare `emit_ocsf_event`, but the gateway hosts many sandboxes, so it stamps a /// per-event `sandbox_id` field here instead. One tracing event feeds both the /// JSONL audit file and the routing bus. -pub fn emit_ocsf_event_routed(sandbox_id: &str, event: OcsfEvent) { +pub fn emit_ocsf_event_routed(sandbox_id: &str, mut event: OcsfEvent) { + crate::trace::enrich(&mut event); let message = event.format_shorthand(); set_current_event(event); tracing::info!(target: "ocsf", sandbox_id = %sandbox_id, message = %message); diff --git a/crates/openshell-otel/src/correlation.rs b/crates/openshell-otel/src/correlation.rs new file mode 100644 index 0000000000..7c01c067c8 --- /dev/null +++ b/crates/openshell-otel/src/correlation.rs @@ -0,0 +1,26 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +//! Sampled trace correlation for OCSF producers. + +use opentelemetry::trace::TraceContextExt as _; +use tracing_opentelemetry::OpenTelemetrySpanExt as _; + +/// Extract the active span's W3C trace ID for an OCSF event. +/// +/// Returns `None` unless the current span has valid, sampled context. This reads +/// the current span without extracting workload HTTP headers or environment +/// variables. The active span may already inherit a gateway caller's context, +/// including before authentication. This is a correlation hint, not proof of +/// origin. A sampled ID does not guarantee export or retention. +#[must_use] +pub fn current_ocsf_trace_correlation() -> Option { + let context = tracing::Span::current().context(); + let span = context.span(); + let span_context = span.span_context(); + (span_context.is_valid() && span_context.is_sampled()).then(|| { + openshell_ocsf::TraceCorrelation { + uid: span_context.trace_id().to_string(), + } + }) +} diff --git a/crates/openshell-otel/src/lib.rs b/crates/openshell-otel/src/lib.rs index 78b995ee0d..1f9de6bf17 100644 --- a/crates/openshell-otel/src/lib.rs +++ b/crates/openshell-otel/src/lib.rs @@ -3,6 +3,9 @@ //! Shared OpenTelemetry trace and log export support for `OpenShell` services. +mod correlation; +pub use correlation::current_ocsf_trace_correlation; + mod driver; mod grpc; mod headers; @@ -54,6 +57,18 @@ use tracing_subscriber::Layer as _; use tracing_subscriber::layer::{Context, Filter}; use tracing_subscriber::registry::LookupSpan; +/// Export supervisor spans at INFO by default, or DEBUG and TRACE when enabled. +/// Dependency spans remain at INFO. +#[must_use] +pub fn supervisor_span_filter(log_level: &str) -> tracing_subscriber::EnvFilter { + use tracing_subscriber::filter::LevelFilter; + let level = log_level + .parse::() + .unwrap_or(LevelFilter::INFO) + .max(LevelFilter::INFO); + tracing_subscriber::EnvFilter::new(format!("info,openshell={level}")) +} + const SDK_UNKNOWN_SERVICE_PREFIX: &str = "unknown_service"; /// Build the resource attributes shared by gateway and compute-driver providers. @@ -566,6 +581,15 @@ pub(crate) fn test_lock() -> std::sync::MutexGuard<'static, ()> { mod tests { use super::*; + #[test] + fn supervisor_span_filter_raises_only_openshell_targets() { + let directives = |log_level: &str| supervisor_span_filter(log_level).to_string(); + assert_eq!(directives("warn"), "openshell=info,info"); + assert_eq!(directives("info"), "openshell=info,info"); + assert_eq!(directives("debug"), "openshell=debug,info"); + assert_eq!(directives("info,h2=debug"), "openshell=info,info"); + } + #[test] fn error_status_guard_marks_only_unfinished_results() { use tracing_subscriber::layer::SubscriberExt as _; diff --git a/crates/openshell-otel/src/ocsf.rs b/crates/openshell-otel/src/ocsf.rs index 3ad4dd7173..c1a301264f 100644 --- a/crates/openshell-otel/src/ocsf.rs +++ b/crates/openshell-otel/src/ocsf.rs @@ -479,6 +479,36 @@ mod tests { assert_eq!(body(&record(&event)), native(&event)); } + #[test] + fn trace_body_preserves_native_correlation_without_mutating_the_source() { + let event = ConfigStateChangeBuilder::new(&event_context("sandbox-1")) + .trace(openshell_ocsf::TraceCorrelation { + uid: "0af7651916cd43dd8448eb211c80319c".to_string(), + }) + .build(); + let before = native(&event); + let native_body = body(&record(&event)); + assert_eq!(native_body, native(&event)); + assert_eq!( + native_body["trace"]["uid"], + "0af7651916cd43dd8448eb211c80319c" + ); + assert!( + native_body["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|profile| profile == "trace") + ); + + assert_eq!( + native_body["metadata"]["version"], + openshell_ocsf::OCSF_VERSION + ); + assert_eq!(native(&event), before); + assert_eq!(native(&event), native_body); + } + #[test] fn timestamps_are_event_time_and_observed_time() { let event = event("sandbox-1", SeverityId::Informational); diff --git a/crates/openshell-otel/tests/ocsf_correlation.rs b/crates/openshell-otel/tests/ocsf_correlation.rs new file mode 100644 index 0000000000..55874c7f80 --- /dev/null +++ b/crates/openshell-otel/tests/ocsf_correlation.rs @@ -0,0 +1,239 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +use std::sync::{Arc, LazyLock, Mutex}; + +use openshell_ocsf::{BaseEventBuilder, OcsfJsonlLayer, TraceCorrelation, ocsf_emit}; +use opentelemetry_sdk::trace::{InMemorySpanExporterBuilder, Sampler, SdkTracerProvider}; +use tracing_subscriber::prelude::*; + +static SETUP: LazyLock<()> = LazyLock::new(|| { + tracing::subscriber::set_global_default(tracing_subscriber::registry()).unwrap(); + assert!(openshell_ocsf::register_trace_correlation_extractor( + openshell_otel::current_ocsf_trace_correlation, + )); +}); + +#[derive(Clone)] +struct Writer(Arc>>); +impl std::io::Write for Writer { + fn write(&mut self, bytes: &[u8]) -> std::io::Result { + self.0.lock().unwrap().extend_from_slice(bytes); + Ok(bytes.len()) + } + fn flush(&mut self) -> std::io::Result<()> { + Ok(()) + } +} + +fn capture( + sampler: Sampler, + active: bool, + explicit: Option, +) -> (serde_json::Value, Vec) { + capture_route(sampler, active, explicit, false) +} + +fn capture_route( + sampler: Sampler, + active: bool, + explicit: Option, + routed: bool, +) -> (serde_json::Value, Vec) { + capture_context(sampler, active, explicit, routed, None) +} + +fn capture_context( + sampler: Sampler, + active: bool, + explicit: Option, + routed: bool, + remote_parent: Option, +) -> (serde_json::Value, Vec) { + LazyLock::force(&SETUP); + let exporter = InMemorySpanExporterBuilder::new().build(); + let provider = SdkTracerProvider::builder() + .with_sampler(sampler) + .with_simple_exporter(exporter.clone()) + .build(); + let bytes = Arc::new(Mutex::new(vec![])); + let subscriber = tracing_subscriber::registry() + .with(openshell_otel::layer(&provider, "ocsf-test")) + .with(OcsfJsonlLayer::new(Writer(bytes.clone()))); + tracing::subscriber::with_default(subscriber, || { + let gateway_request = remote_parent.is_some(); + let emit = || { + let ctx = openshell_ocsf::ctx::ctx(); + if gateway_request { + ocsf_emit!( + openshell_ocsf::AuthenticationBuilder::new( + ctx, + openshell_ocsf::User::unidentified(), + openshell_ocsf::Service::new("openshell-gateway"), + ) + .status(openshell_ocsf::StatusId::Failure) + .build() + ); + return; + } + let mut builder = BaseEventBuilder::new(ctx); + if let Some(trace) = explicit { + builder = builder.trace(trace); + } + if routed { + openshell_ocsf::emit_ocsf_event_routed("test-sandbox", builder.build()); + } else { + ocsf_emit!(builder.build()); + } + }; + if active { + let span = tracing::info_span!("sampled-operation"); + if let Some(parent) = remote_parent { + use opentelemetry::trace::TraceContextExt as _; + use tracing_opentelemetry::OpenTelemetrySpanExt as _; + span.set_parent(opentelemetry::Context::new().with_remote_span_context(parent)) + .unwrap(); + } + span.in_scope(emit); + } else { + emit(); + } + }); + let value = serde_json::from_slice(&bytes.lock().unwrap()).unwrap(); + provider.force_flush().unwrap(); + let spans = exporter.get_finished_spans().unwrap(); + provider.shutdown().unwrap(); + (value, spans) +} + +#[test] +fn authentication_failure_correlation_can_inherit_sampled_or_unsampled_caller_context() { + use opentelemetry::trace::{SpanContext, SpanId, TraceFlags, TraceId, TraceState}; + let uid = "0af7651916cd43dd8448eb211c80319c"; + for sampled in [true, false] { + let parent = SpanContext::new( + TraceId::from_hex(uid).unwrap(), + SpanId::from_hex("b7ad6b7169203331").unwrap(), + if sampled { + TraceFlags::SAMPLED + } else { + TraceFlags::default() + }, + true, + TraceState::default(), + ); + let (event, spans) = capture_context( + Sampler::ParentBased(Box::new(Sampler::AlwaysOn)), + true, + None, + false, + Some(parent), + ); + assert_eq!(event["class_uid"], 3002); + assert_eq!(event["status_id"], 2); + if sampled { + assert_eq!(event["trace"]["uid"], uid); + assert_eq!(spans.len(), 1); + assert_eq!(spans[0].span_context.trace_id().to_string(), uid); + } else { + assert_no_trace(&event); + assert!(spans.is_empty()); + } + } +} + +fn assert_no_trace(value: &serde_json::Value) { + assert!(value.get("trace").is_none()); + assert!( + !value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|p| p == "trace") + ); +} + +#[test] +fn sampled_active_span_correlates_to_exported_w3c_trace() { + let (value, spans) = capture(Sampler::AlwaysOn, true, None); + let uid = value["trace"]["uid"].as_str().unwrap(); + assert_eq!(uid.len(), 32); + assert!( + uid.bytes() + .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b)) + ); + assert_eq!(uid, spans[0].span_context.trace_id().to_string()); + assert_eq!( + value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .filter(|p| *p == "trace") + .count(), + 1 + ); + assert_eq!(value["trace"].as_object().unwrap().len(), 1); +} + +#[test] +fn no_active_context_omits_trace_and_profile() { + let (value, spans) = capture(Sampler::AlwaysOn, false, None); + assert_no_trace(&value); + assert!(spans.is_empty()); +} + +#[test] +fn routed_emission_also_enriches_from_sampled_context() { + let (value, spans) = capture_route(Sampler::AlwaysOn, true, None, true); + assert_eq!( + value["trace"]["uid"], + spans[0].span_context.trace_id().to_string() + ); + assert!( + value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|p| p == "trace") + ); +} + +#[test] +fn unsampled_active_context_omits_trace_and_profile() { + let (value, spans) = capture(Sampler::AlwaysOff, true, None); + assert_no_trace(&value); + assert!(spans.is_empty()); +} + +#[test] +fn explicit_trace_overrides_automatic_enrichment() { + let explicit = "0af7651916cd43dd8448eb211c80319c"; + let (value, spans) = capture( + Sampler::AlwaysOn, + true, + Some(TraceCorrelation { + uid: explicit.to_string(), + }), + ); + assert_eq!(value["trace"]["uid"], explicit); + assert_ne!(explicit, spans[0].span_context.trace_id().to_string()); + assert_eq!( + value["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .filter(|p| *p == "trace") + .count(), + 1 + ); +} + +#[test] +fn active_tracing_span_without_otel_context_is_invalid() { + LazyLock::force(&SETUP); + tracing::subscriber::with_default(tracing_subscriber::registry(), || { + tracing::info_span!("no-otel-layer").in_scope(|| { + assert!(openshell_otel::current_ocsf_trace_correlation().is_none()); + }); + }); +} diff --git a/crates/openshell-server/src/cli.rs b/crates/openshell-server/src/cli.rs index 1f0f215881..55ad3091ea 100644 --- a/crates/openshell-server/src/cli.rs +++ b/crates/openshell-server/src/cli.rs @@ -799,6 +799,10 @@ async fn run_from_args( let prepared = prepare_server_config_with_drivers(&mut args, &matches, &compute_drivers)?; validate_user_auth(&prepared.config)?; + openshell_ocsf::register_trace_correlation_extractor( + openshell_otel::current_ocsf_trace_correlation, + ); + // Initialize OCSF identity before tracing can emit gateway events. let gateway_identity = crate::gateway_ocsf::GatewayIdentity { name: prepared.config.name.clone(), diff --git a/crates/openshell-supervisor-network/Cargo.toml b/crates/openshell-supervisor-network/Cargo.toml index aa3ca35014..7043f30d24 100644 --- a/crates/openshell-supervisor-network/Cargo.toml +++ b/crates/openshell-supervisor-network/Cargo.toml @@ -67,10 +67,12 @@ bundled-ca-roots = ["dep:webpki-roots"] openshell-sandbox-backend = { path = "../openshell-sandbox-backend", features = ["test-support"] } openshell-driver-vm = { path = "../openshell-driver-vm", default-features = false, features = ["allocation-tracking"] } +openshell-otel-test-support = { path = "../openshell-otel-test-support" } openshell-ocsf = { path = "../openshell-ocsf", features = ["test-support"] } openshell-ocsf-validate = { path = "../openshell-ocsf-validate" } openshell-otel = { path = "../openshell-otel" } openshell-supervisor-middleware-builtins = { path = "../openshell-supervisor-middleware-builtins" } +opentelemetry-proto = { workspace = true } opentelemetry_sdk = { workspace = true, features = ["testing"] } temp-env = "0.3" tokio = { workspace = true, features = ["test-util"] } diff --git a/crates/openshell-supervisor-network/src/google_cloud_metadata.rs b/crates/openshell-supervisor-network/src/google_cloud_metadata.rs index aec80473a3..ea5d0c16bd 100644 --- a/crates/openshell-supervisor-network/src/google_cloud_metadata.rs +++ b/crates/openshell-supervisor-network/src/google_cloud_metadata.rs @@ -16,8 +16,10 @@ use http::StatusCode; use miette::{IntoDiagnostic, Result}; use openshell_core::provider_credentials::ProviderCredentialState; use openshell_ocsf::{ - ActivityId, HttpActivityBuilder, HttpRequest, SeverityId, StatusId, ocsf_emit, + ActionId, ActivityId, DispositionId, HttpActivityBuilder, HttpRequest, SeverityId, StatusId, }; + +use crate::telemetry::egress_emit; use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt}; type MetadataResponse = (u16, &'static str, String); @@ -311,7 +313,7 @@ fn emit_metadata_event( status: StatusId, message: &str, ) { - ocsf_emit!(build_metadata_event( + egress_emit!(build_metadata_event( method, response_code, severity, @@ -327,7 +329,7 @@ fn build_metadata_event( status: StatusId, message: &str, ) -> openshell_ocsf::OcsfEvent { - HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + let mut builder = HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::for_http_method(method)) .http_request(HttpRequest { http_method: method.parse().expect("HTTP method parsing is infallible"), @@ -338,8 +340,13 @@ fn build_metadata_event( }) .severity(severity) .status(status) - .message(message.to_string()) - .build() + .message(message.to_string()); + if matches!(response_code, 403 | 405) { + builder = builder + .action(ActionId::Denied) + .disposition(DispositionId::Blocked); + } + builder.build() } #[cfg(test)] @@ -347,6 +354,26 @@ mod tests { use super::*; use std::collections::HashMap; + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn metadata_rejections_have_deny_traces_but_operational_failures_do_not() { + use crate::telemetry::tests::{assert_deny_resolves, exported}; + + let (events, received) = exported("warn", || { + let ctx = make_context(HashMap::new()); + route_request(&ctx, "GET", PATH_TOKEN, &[]); + route_request(&ctx, "POST", PATH_TOKEN, &flavor_headers()); + route_request(&ctx, "GET", "/unknown", &flavor_headers()); + route_request(&ctx, "GET", PATH_TOKEN, &flavor_headers()); + }) + .await; + assert_eq!(events.len(), 4); + assert_deny_resolves(&events[..2], &received, true); + for event in &events[2..] { + assert!(event.get("trace").is_none()); + } + assert_eq!(received.spans.len(), 2); + } + fn token_binding() -> openshell_core::proto::StaticCredentialBinding { openshell_core::proto::StaticCredentialBinding { endpoints: vec![openshell_core::proto::StaticCredentialEndpointBinding { diff --git a/crates/openshell-supervisor-network/src/l7/middleware.rs b/crates/openshell-supervisor-network/src/l7/middleware.rs index de2aa20613..38612c2bee 100644 --- a/crates/openshell-supervisor-network/src/l7/middleware.rs +++ b/crates/openshell-supervisor-network/src/l7/middleware.rs @@ -5,10 +5,11 @@ use crate::l7::relay::L7EvalContext; use crate::opa::PolicyGenerationGuard; +use crate::telemetry::egress_emit; use miette::{Result, miette}; use openshell_ocsf::{ ActionId, ActivityId, DetectionFindingBuilder, DispositionId, Endpoint, FindingInfo, - HttpActivityBuilder, HttpRequest, NetworkActivityBuilder, SeverityId, StatusId, ocsf_emit, + HttpActivityBuilder, HttpRequest, NetworkActivityBuilder, SeverityId, StatusId, }; use std::path::PathBuf; use tokio::io::{AsyncRead, AsyncWrite}; @@ -168,24 +169,23 @@ pub fn emit_middleware_uninspectable(ctx: &L7EvalContext, detail: &str, denied: "Uninspectable traffic bypassed middleware (fail_open)" }) .build(); - ocsf_emit!(event); + egress_emit!(denied: denied, event); } pub fn emit_websocket_preflight_events( ctx: &L7EvalContext, outcome: &openshell_supervisor_middleware::WebSocketPreflightResult, ) { - emit_websocket_invocations(ctx, &outcome.invocations); - emit_websocket_coverage(ctx, &outcome.coverage); - for event in websocket_preflight_finding_events(outcome) { - ocsf_emit!(event); + let mut events = websocket_invocation_events(ctx, &outcome.invocations); + events.extend(websocket_coverage_events(ctx, &outcome.coverage)); + events.extend(websocket_preflight_finding_events(outcome)); + if outcome.session_capacity_exhausted { + events.push(middleware_session_capacity_exhausted_event(ctx)); } + crate::telemetry::emit_decision(events, None, !outcome.allowed); if outcome.saturated { emit_websocket_saturation(ctx); } - if outcome.session_capacity_exhausted { - emit_middleware_session_capacity_exhausted(ctx); - } } pub(super) fn emit_websocket_coverage( @@ -193,7 +193,7 @@ pub(super) fn emit_websocket_coverage( coverage: &[openshell_supervisor_middleware::WebSocketCoverage], ) { for event in websocket_coverage_events(ctx, coverage) { - ocsf_emit!(event); + egress_emit!(event); } } @@ -251,20 +251,23 @@ pub(super) fn emit_websocket_session_start_events( ctx: &L7EvalContext, outcome: &openshell_supervisor_middleware::WebSocketSessionStartOutcome, ) { - emit_websocket_invocations(ctx, &outcome.invocations); + crate::telemetry::emit_decision( + websocket_invocation_events(ctx, &outcome.invocations), + None, + !outcome.allowed, + ); } pub(super) fn emit_websocket_message_events( ctx: &L7EvalContext, outcome: &openshell_supervisor_middleware::WebSocketMessageOutcome, ) { - emit_websocket_invocations(ctx, &outcome.invocations); + let mut events = websocket_invocation_events(ctx, &outcome.invocations); + events.extend(websocket_message_finding_events(outcome)); + crate::telemetry::emit_decision(events, None, !outcome.allowed); if outcome.saturated { emit_websocket_saturation(ctx); } - for event in websocket_message_finding_events(outcome) { - ocsf_emit!(event); - } } pub(super) fn websocket_preflight_finding_events( @@ -311,10 +314,11 @@ pub(super) fn middleware_finding_events( .collect() } -fn emit_websocket_invocations( +fn websocket_invocation_events( ctx: &L7EvalContext, invocations: &[openshell_supervisor_middleware::WebSocketInvocation], -) { +) -> Vec { + let mut events = Vec::new(); for invocation in invocations { use openshell_supervisor_middleware::WebSocketInvocationOutcome as Outcome; let (action, disposition, severity, status, outcome_name) = match invocation.outcome { @@ -385,7 +389,7 @@ fn emit_websocket_invocations( invocation.transformed, )) .build(); - ocsf_emit!(event); + events.push(event); if invocation.failed { let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(if invocation.outcome == Outcome::FailClosed { @@ -406,7 +410,7 @@ fn emit_websocket_invocations( ]) .message("WebSocket middleware stage failed") .build(); - ocsf_emit!(event); + events.push(event); } if invocation.stage_disabled { let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) @@ -426,9 +430,10 @@ fn emit_websocket_invocations( "WebSocket middleware stage stream became unusable and was disabled for this session", ) .build(); - ocsf_emit!(event); + events.push(event); } } + events } fn emit_websocket_saturation(ctx: &L7EvalContext) { @@ -445,11 +450,11 @@ fn emit_websocket_saturation(ctx: &L7EvalContext) { ]) .message("WebSocket middleware work waited for admission capacity") .build(); - ocsf_emit!(event); + egress_emit!(event); } -fn emit_middleware_session_capacity_exhausted(ctx: &L7EvalContext) { - let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) +fn middleware_session_capacity_exhausted_event(ctx: &L7EvalContext) -> openshell_ocsf::OcsfEvent { + DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Medium) .finding_info(FindingInfo::new( "openshell.middleware.session_capacity_exhausted", @@ -461,8 +466,7 @@ fn emit_middleware_session_capacity_exhausted(ctx: &L7EvalContext) { ("operation", "websocket_message"), ]) .message("Persistent middleware session admission was refused at process capacity") - .build(); - ocsf_emit!(event); + .build() } fn middleware_admission_exhausted_event(ctx: &L7EvalContext) -> openshell_ocsf::OcsfEvent { @@ -483,7 +487,7 @@ fn middleware_admission_exhausted_event(ctx: &L7EvalContext) -> openshell_ocsf:: } fn emit_middleware_admission_exhausted(ctx: &L7EvalContext) { - ocsf_emit!(middleware_admission_exhausted_event(ctx)); + egress_emit!(denied: true, middleware_admission_exhausted_event(ctx)); } /// Largest body-buffering limit across the entries that actually resolved to a @@ -811,7 +815,7 @@ fn emit_middleware_body_unavailable(ctx: &L7EvalContext, denied: bool) { "Request body exceeded middleware inspection cap; passed through (fail_open)" }) .build(); - ocsf_emit!(event); + egress_emit!(denied: denied, event); } /// Parse the raw header block into middleware-visible headers, preserving @@ -999,8 +1003,223 @@ fn emit_middleware_events( req: &crate::l7::provider::L7Request, outcome: &openshell_supervisor_middleware::ChainOutcome, ) { - for event in middleware_events(ctx, req, outcome) { - ocsf_emit!(event); + crate::telemetry::emit_decision(middleware_events(ctx, req, outcome), None, !outcome.allowed); +} + +#[cfg(test)] +mod trace_tests { + use super::*; + use crate::telemetry::tests::{assert_deny_resolves, exported}; + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn default_level_middleware_deny_finding_is_inside_exported_deny_span() { + let (events, received) = exported("warn", || { + let ctx = L7EvalContext { + host: "blocked.example".to_string(), + port: 443, + policy_name: "middleware-policy".to_string(), + ..Default::default() + }; + emit_middleware_uninspectable(&ctx, "unknown protocol", true); + }) + .await; + assert_eq!(events.len(), 1); + assert_eq!(events[0]["class_uid"], 2004); + assert_deny_resolves(&events, &received, true); + crate::telemetry::tests::assert_deny_attribute( + &received, + "openshell.policy.name", + "middleware-policy", + ); + crate::telemetry::tests::assert_deny_attribute( + &received, + "server.address", + "blocked.example", + ); + } + + fn finding() -> openshell_supervisor_middleware::NamespacedFinding { + openshell_supervisor_middleware::NamespacedFinding { + middleware: "guard".to_string(), + finding: openshell_core::proto::Finding { + r#type: "test.finding".to_string(), + label: "Test finding".to_string(), + count: 1, + severity: "high".to_string(), + ..Default::default() + }, + } + } + + fn assert_decision( + events: &[serde_json::Value], + received: &openshell_otel_test_support::ReceivedTraces, + denied: bool, + ) { + assert!(!events.is_empty()); + let deny_count = received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .count(); + assert_eq!(deny_count, usize::from(denied)); + if denied { + assert_deny_resolves(events, received, true); + assert!( + events + .iter() + .all(|event| event["trace"]["uid"] == events[0]["trace"]["uid"]) + ); + } else { + assert!(events.iter().all(|event| event.get("trace").is_none())); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn http_chain_outcomes_group_findings_and_preserve_allowed_controls() { + for allowed in [true, false] { + let (events, received) = exported("warn", || { + let outcome = openshell_supervisor_middleware::ChainOutcome { + allowed, + reason: if allowed { + "allowed" + } else { + "middleware_failed: guard" + } + .to_string(), + body: vec![], + header_mutations: vec![], + findings: vec![finding()], + metadata: std::collections::BTreeMap::new(), + applied: vec![openshell_supervisor_middleware::MiddlewareInvocation { + name: "guard".to_string(), + implementation: "test/guard".to_string(), + decision: if allowed { + openshell_core::proto::Decision::Allow + } else { + openshell_core::proto::Decision::Deny + }, + transformed: false, + failed: false, + }], + denial: None, + }; + let request = crate::l7::provider::L7Request { + action: "POST".to_string(), + target: "/".to_string(), + query_params: std::collections::HashMap::new(), + raw_header: vec![], + body_length: crate::l7::provider::BodyLength::None, + }; + emit_middleware_events(&L7EvalContext::default(), &request, &outcome); + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert!(events.len() >= 2); + assert_decision(&events, &received, !allowed); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn websocket_outcomes_group_domain_and_findings_with_fail_open_controls() { + use openshell_supervisor_middleware::WebSocketInvocationOutcome as Outcome; + for route in ["preflight", "message", "session-start"] { + for outcome in [ + Outcome::Allow, + Outcome::Deny, + Outcome::FailOpen, + Outcome::FailClosed, + ] { + let denied = matches!(outcome, Outcome::Deny | Outcome::FailClosed); + let (events, received) = exported("warn", || { + let ctx = L7EvalContext::default(); + let invocations = vec![openshell_supervisor_middleware::WebSocketInvocation { + config_name: "guard".to_string(), + implementation: "test/guard".to_string(), + outcome, + sequence: None, + original_size: 0, + replacement_size: None, + transformed: false, + failed: matches!(outcome, Outcome::FailOpen | Outcome::FailClosed), + stage_disabled: outcome == Outcome::FailOpen, + reason_code: None, + }]; + match route { + "preflight" => emit_websocket_preflight_events( + &ctx, + &openshell_supervisor_middleware::WebSocketPreflightResult { + allowed: !denied, + terminal_reason: None, + reason: "test".to_string(), + denial: None, + session: None, + findings: vec![finding()], + metadata: std::collections::BTreeMap::new(), + invocations, + coverage: vec![], + saturated: false, + session_capacity_exhausted: false, + }, + ), + "message" => emit_websocket_message_events( + &ctx, + &openshell_supervisor_middleware::WebSocketMessageOutcome { + allowed: !denied, + reason: "test".to_string(), + payload: String::new(), + findings: vec![finding()], + metadata: std::collections::BTreeMap::new(), + invocations, + denial: None, + saturated: false, + platform_oversize: false, + }, + ), + _ => emit_websocket_session_start_events( + &ctx, + &openshell_supervisor_middleware::WebSocketSessionStartOutcome { + allowed: !denied, + terminal_reason: None, + reason: "test".to_string(), + invocations, + }, + ), + } + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert_decision(&events, &received, denied); + } + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn session_capacity_only_traces_fail_closed_refusals() { + for allowed in [true, false] { + let (events, received) = exported("warn", || { + emit_websocket_preflight_events( + &L7EvalContext::default(), + &openshell_supervisor_middleware::WebSocketPreflightResult { + allowed, + terminal_reason: None, + reason: "middleware_session_capacity_exhausted".to_string(), + denial: None, + session: None, + findings: vec![], + metadata: std::collections::BTreeMap::new(), + invocations: vec![], + coverage: vec![], + saturated: false, + session_capacity_exhausted: true, + }, + ); + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert_eq!(events.len(), 1); + assert_decision(&events, &received, !allowed); + } } } diff --git a/crates/openshell-supervisor-network/src/l7/mod.rs b/crates/openshell-supervisor-network/src/l7/mod.rs index 37849b9c0c..cd6673f861 100644 --- a/crates/openshell-supervisor-network/src/l7/mod.rs +++ b/crates/openshell-supervisor-network/src/l7/mod.rs @@ -417,7 +417,7 @@ pub fn parse_l7_config(val: ®orus::Value) -> Option { "rejecting endpoint: unrecognized credential_signing value {other:?}" )) .build(); - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); return None; } _ => CredentialSigning::None, @@ -433,7 +433,7 @@ pub fn parse_l7_config(val: ®orus::Value) -> Option { .state(openshell_ocsf::StateId::Disabled, "invalid") .message("rejecting endpoint: credential_signing requires signing_service".to_string()) .build(); - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); return None; } @@ -460,8 +460,12 @@ pub fn parse_l7_config(val: ®orus::Value) -> Option { }) } -pub(crate) fn emit_uninspected_credential_finding(host: &str, policy_name: &str, surface: &str) { - let event = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) +pub(crate) fn build_uninspected_credential_finding( + host: &str, + policy_name: &str, + surface: &str, +) -> openshell_ocsf::OcsfEvent { + openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.credentials.traffic_uninspectable", @@ -474,8 +478,7 @@ pub(crate) fn emit_uninspected_credential_finding(host: &str, policy_name: &str, ("disposition", "denied"), ]) .message("Uninspected credential-bearing traffic denied") - .build(); - openshell_ocsf::ocsf_emit!(event); + .build() } impl L7EndpointConfig { diff --git a/crates/openshell-supervisor-network/src/l7/relay.rs b/crates/openshell-supervisor-network/src/l7/relay.rs index b4acb5e52f..05b5c7de4d 100644 --- a/crates/openshell-supervisor-network/src/l7/relay.rs +++ b/crates/openshell-supervisor-network/src/l7/relay.rs @@ -20,6 +20,7 @@ use crate::l7::provider::{L7Provider, RelayOutcome}; use crate::l7::rest::WebSocketExtensionMode; use crate::l7::{EndpointObserver, EnforcementMode, L7EndpointConfig, L7Protocol, L7RequestInfo}; use crate::opa::{PolicyGenerationGuard, TunnelPolicyEngine}; +use crate::telemetry::egress_emit; use miette::{IntoDiagnostic, Result, miette}; use openshell_core::activity::{ActivitySender, try_record_activity}; use openshell_core::endpoint_status::{EndpointObservationSender, EndpointResult}; @@ -27,7 +28,6 @@ use openshell_core::secrets::{self, SecretResolver}; use openshell_ocsf::{ ActionId, ActivityId, DetectionFindingBuilder, DispositionId, Endpoint, FindingInfo, HttpActivityBuilder, HttpRequest, NetworkActivityBuilder, SeverityId, StatusId, Url as OcsfUrl, - ocsf_emit, }; #[cfg(test)] use std::collections::BTreeMap; @@ -287,8 +287,14 @@ where .into_diagnostic()?; client.flush().await.into_diagnostic()?; - ocsf_emit!(build_request_authority_mismatch_event(ctx, method)); - ocsf_emit!(build_request_authority_mismatch_finding(ctx)); + crate::telemetry::emit_decision( + [ + build_request_authority_mismatch_event(ctx, method), + build_request_authority_mismatch_finding(ctx), + ], + None, + false, + ); Ok(()) } @@ -338,7 +344,7 @@ where crate::l7::mcp::selected_revision_context(request, version) ); let summary = l7_protocol_log_summary(None, Some(&info)); - ocsf_emit!(build_l7_request_event( + egress_emit!(build_l7_request_event( ctx, &request.action, redacted_target, @@ -419,7 +425,7 @@ where } let reason = error.rejection_detail(request); let summary = l7_protocol_log_summary(None, Some(info)); - ocsf_emit!(build_l7_request_event( + egress_emit!(build_l7_request_event( ctx, &request.action, redacted_target, @@ -616,8 +622,8 @@ where .into_diagnostic()?; client.flush().await.into_diagnostic()?; - if placement_mismatch { - ocsf_emit!( + let mut events = if placement_mismatch { + vec![ HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::for_http_method(method)) .http_request(method_only_request(method)) @@ -630,24 +636,24 @@ where .firewall_rule(&ctx.policy_name, "credential-binding") .message("Credential use denied: unauthorized request location") .status_detail("credential_placement_mismatch") - .build() - ); - ocsf_emit!(crate::l7::build_credential_placement_mismatch_finding( - &ctx.policy_name, - &ctx.host, - None, - )); + .build(), + crate::l7::build_credential_placement_mismatch_finding( + &ctx.policy_name, + &ctx.host, + None, + ), + ] } else { - ocsf_emit!(build_credential_resolution_event( + vec![build_credential_resolution_event( ctx, method, - endpoint_mismatch - )); - } - + endpoint_mismatch, + )] + }; if endpoint_mismatch { - ocsf_emit!(build_credential_endpoint_mismatch_finding(ctx)); + events.push(build_credential_endpoint_mismatch_finding(ctx)); } + crate::telemetry::emit_decision(events, None, false); Ok(()) } @@ -1041,7 +1047,7 @@ fn emit_parse_rejection(ctx: &L7EvalContext, detail: &str, engine_type: &str) { )) .status_detail(detail) .build(); - ocsf_emit!(event); + egress_emit!(event); emit_activity(ctx, true, "l7_parse_rejection"); } @@ -1157,7 +1163,7 @@ where .dst_endpoint(Endpoint::from_domain(&ctx.host, ctx.port)) .message("SQL L7 provider not yet implemented, falling back to passthrough") .build(); - ocsf_emit!(event); + egress_emit!(event); } tokio::io::copy_bidirectional(client, upstream) .await @@ -1690,7 +1696,7 @@ fn emit_l7_request_log( reason, protocol_summary, ); - ocsf_emit!(event); + egress_emit!(event); emit_activity(ctx, decision_str == "deny", "l7_policy"); } @@ -1856,7 +1862,7 @@ where } else { "raw bidirectional relay (L7 enforcement no longer active)" }; - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Other) .activity_name("Upgrade") @@ -2199,7 +2205,7 @@ where request_info.action, ctx.host, ctx.port, redacted_target, reason, )) .build(); - ocsf_emit!(event); + egress_emit!(event); } if allowed || config.enforcement == EnforcementMode::Audit { @@ -2407,7 +2413,7 @@ pub(crate) fn emit_policy_reload( port: u16, policy_name: &str, ) { - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -2627,7 +2633,7 @@ where &reason, )) .build(); - ocsf_emit!(event); + egress_emit!(event); } if allowed || (config.enforcement == EnforcementMode::Audit && !force_deny) { @@ -2909,7 +2915,7 @@ where request_info.action, ctx.host, ctx.port, redacted_target, reason, )) .build(); - ocsf_emit!(event); + egress_emit!(event); } if allowed || (config.enforcement == EnforcementMode::Audit && !force_deny) { @@ -3380,7 +3386,7 @@ fn emit_transformed_body_decision( request_info.action, ctx.host, ctx.port, request_info.target, reason )) .build(); - ocsf_emit!(event); + egress_emit!(event); } fn jsonrpc_policy_input(info: &crate::l7::jsonrpc::JsonRpcRequestInfo) -> serde_json::Value { @@ -3613,7 +3619,7 @@ where req.action, ctx.host, ctx.port, redacted_target, )) .build(); - ocsf_emit!(event); + egress_emit!(event); } let request_id = uuid::Uuid::new_v4().to_string(); @@ -3785,6 +3791,63 @@ where Ok(()) } +#[cfg(test)] +mod trace_tests { + use super::*; + use crate::telemetry::tests::{assert_deny_resolves, exported}; + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn authority_mismatch_domain_and_finding_share_one_trace() { + let (events, received) = exported("warn", || { + let ctx = L7EvalContext { + host: "blocked.example".to_string(), + port: 443, + ..Default::default() + }; + let mut response = Vec::new(); + futures::executor::block_on(reject_request_authority_mismatch( + &mut response, + &ctx, + "POST", + )) + .unwrap(); + assert!(response.starts_with(b"HTTP/1.1 403 Forbidden")); + }) + .await; + assert_eq!(events.len(), 2); + assert_eq!(received.spans.len(), 1); + assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); + assert_deny_resolves(&events, &received, true); + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn default_level_l7_relay_deny_uid_resolves_to_one_span_root_trace() { + let (events, received) = exported("warn", || { + let ctx = L7EvalContext { + host: "blocked.example".to_string(), + port: 443, + policy_name: "rest-policy".to_string(), + ..Default::default() + }; + emit_parse_rejection(&ctx, "ambiguous framing", "l7-rest"); + }) + .await; + assert_eq!(events.len(), 1); + assert_deny_resolves(&events, &received, true); + assert_eq!(received.spans.len(), 1); + crate::telemetry::tests::assert_deny_attribute( + &received, + "openshell.policy.name", + "rest-policy", + ); + crate::telemetry::tests::assert_deny_attribute( + &received, + "server.address", + "blocked.example", + ); + } +} + #[cfg(test)] mod tests { use super::*; diff --git a/crates/openshell-supervisor-network/src/l7/rest.rs b/crates/openshell-supervisor-network/src/l7/rest.rs index 7a6a0d6236..e3f458129e 100644 --- a/crates/openshell-supervisor-network/src/l7/rest.rs +++ b/crates/openshell-supervisor-network/src/l7/rest.rs @@ -1184,7 +1184,7 @@ where port = options.port, )) .build(); - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); } _ => { return Err(miette::Report::new(CredentialUnavailableError::new( @@ -1534,7 +1534,6 @@ fn emit_uninspected_body_credential_denial( req.action, options.host, options.port )) .build(); - openshell_ocsf::ocsf_emit!(event); let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( @@ -1548,7 +1547,7 @@ fn emit_uninspected_body_credential_denial( ]) .message("Request body credential placeholder denied") .build(); - openshell_ocsf::ocsf_emit!(finding); + crate::telemetry::emit_decision([event, finding], None, false); } struct PreparedRequestBody { @@ -6916,6 +6915,238 @@ mod tests { (outcome, delivered) } + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_trace_failure_records_share_the_terminal_decision() { + use crate::telemetry::tests::{assert_deny_resolves, exported}; + + // This relay fixture has no CONNECT span, so denies are roots at both + // levels. The thread-local export harness observes the relay task; + // emissions in spawned tasks would need explicit subscriber propagation. + for level in ["warn", "debug"] { + for (method, script) in [ + ("GET", ResponseRelayScript::BlockStream), + ("GET", ResponseRelayScript::InvalidBodySequence), + ("GET", ResponseRelayScript::InvalidWholeBodySequence), + ("HEAD", ResponseRelayScript::WholeBody), + ] { + let (events, received) = exported(level, || { + let (outcome, delivered) = tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on(run_response_middleware_relay( + b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello", + method, + script, + )) + }); + if method == "HEAD" + || matches!(script, ResponseRelayScript::InvalidWholeBodySequence) + { + assert!(matches!(outcome.unwrap(), RelayOutcome::Consumed)); + assert!(delivered.starts_with(b"HTTP/1.1 502 Bad Gateway\r\n")); + } else { + assert!(outcome.is_err()); + assert!(delivered.starts_with(b"HTTP/1.1 200 OK\r\n")); + assert!(!String::from_utf8_lossy(&delivered).contains("502 Bad Gateway")); + } + }) + .await; + let terminal = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.http_response_failure" + }) + .expect("terminal delivery failure is recorded"); + let companions: Vec<_> = events + .iter() + .filter(|event| { + event.get("finding_info").is_some() + || event["unmapped"]["failed"] == true + || event["action_id"] == openshell_ocsf::ActionId::Denied as u8 + }) + .cloned() + .collect(); + assert!(companions.len() >= 2, "failure includes diagnostic records"); + assert_eq!( + received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .count(), + 1, + "one response stop is one exported decision" + ); + assert_deny_resolves(&companions, &received, true); + assert!( + companions + .iter() + .all(|event| event["trace"]["uid"] == terminal["trace"]["uid"]) + ); + } + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_trace_upstream_io_failure_is_not_an_enforced_denial() { + struct FailedReader; + impl AsyncRead for FailedReader { + fn poll_read( + self: Pin<&mut Self>, + _cx: &mut Context<'_>, + _buf: &mut ReadBuf<'_>, + ) -> Poll> { + Poll::Ready(Err(std::io::Error::new( + std::io::ErrorKind::ConnectionReset, + "upstream response interrupted", + ))) + } + } + + for script in [ResponseRelayScript::Stream, ResponseRelayScript::WholeBody] { + let (events, received) = crate::telemetry::tests::exported("warn", || { + tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on(async { + let (runner, chain) = response_middleware_fixture(script); + let mut upstream = b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\n" + .as_slice() + .chain(FailedReader); + let mut delivered = Vec::new(); + let outcome = relay_response( + "GET", + &mut upstream, + &mut delivered, + RelayResponseOptions::default(), + Some(response_middleware_context(&runner, &chain, "GET")), + ) + .await; + if matches!(script, ResponseRelayScript::Stream) { + assert!(outcome.is_err()); + assert!(delivered.starts_with(b"HTTP/1.1 200 OK\r\n")); + assert!( + !String::from_utf8_lossy(&delivered).contains("502 Bad Gateway") + ); + } else { + assert!(matches!(outcome.unwrap(), RelayOutcome::Consumed)); + assert!(delivered.starts_with(b"HTTP/1.1 502 Bad Gateway\r\n")); + } + }); + }); + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert!(events.iter().any(|event| event["finding_info"]["uid"] + == "openshell.middleware.http_response_failure")); + assert!(events.iter().all(|event| event.get("trace").is_none())); + assert!( + !received + .spans + .iter() + .any(|span| span.name == "supervisor.egress.deny") + ); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_trace_downstream_body_failure_is_not_an_enforced_denial() { + #[derive(Default)] + struct DisconnectAfterHead(Vec); + impl AsyncWrite for DisconnectAfterHead { + fn poll_write( + mut self: Pin<&mut Self>, + _cx: &mut Context<'_>, + buf: &[u8], + ) -> Poll> { + if self.0.ends_with(b"\r\n\r\n") { + return Poll::Ready(Err(std::io::Error::new( + std::io::ErrorKind::BrokenPipe, + "client disconnected", + ))); + } + self.0.extend_from_slice(buf); + Poll::Ready(Ok(buf.len())) + } + fn poll_flush( + self: Pin<&mut Self>, + _cx: &mut Context<'_>, + ) -> Poll> { + Poll::Ready(Ok(())) + } + fn poll_shutdown( + self: Pin<&mut Self>, + _cx: &mut Context<'_>, + ) -> Poll> { + Poll::Ready(Ok(())) + } + } + + let (events, received) = crate::telemetry::tests::exported("warn", || { + tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on(async { + let (runner, chain) = response_middleware_fixture(ResponseRelayScript::Stream); + let mut upstream = + b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello".as_slice(); + let mut delivered = DisconnectAfterHead::default(); + let outcome = relay_response( + "GET", + &mut upstream, + &mut delivered, + RelayResponseOptions::default(), + Some(response_middleware_context(&runner, &chain, "GET")), + ) + .await; + assert!(outcome.is_err()); + assert!(delivered.0.starts_with(b"HTTP/1.1 200 OK\r\n")); + assert!(!String::from_utf8_lossy(&delivered.0).contains("502 Bad Gateway")); + }); + }); + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert!( + events.iter().any(|event| event["finding_info"]["uid"] + == "openshell.middleware.http_response_failure") + ); + assert!(events.iter().all(|event| event.get("trace").is_none())); + assert!( + !received + .spans + .iter() + .any(|span| span.name == "supervisor.egress.deny") + ); + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_trace_allowed_and_fail_open_controls_do_not_create_deny_spans() { + for script in [ + ResponseRelayScript::Stream, + ResponseRelayScript::InvalidBodySequence, + ResponseRelayScript::InvalidWholeBodySequence, + ] { + let (events, received) = crate::telemetry::tests::exported("warn", || { + let (outcome, delivered) = tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on( + run_response_middleware_relay_with_error( + b"HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello", + "GET", + script, + openshell_supervisor_middleware::OnError::FailOpen, + ), + ) + }); + assert!(outcome.is_ok()); + assert!(delivered.starts_with(b"HTTP/1.1 200 OK\r\n")); + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert!(!events.is_empty()); + assert!(events.iter().all(|event| event.get("trace").is_none())); + assert!( + !received + .spans + .iter() + .any(|span| span.name == "supervisor.egress.deny") + ); + } + } + #[tokio::test] async fn response_middleware_headers_only_mutates_head_and_preserves_framing() { let (outcome, delivered) = run_response_middleware_relay( diff --git a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs index 3efc323bdb..9b54ea9993 100644 --- a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs +++ b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs @@ -408,16 +408,26 @@ where allowed = preflight.allowed, "HTTP response middleware preflight completed" ); - for event in crate::l7::middleware::middleware_finding_events(&preflight.findings) { - openshell_ocsf::ocsf_emit!(event); - } + let mut preflight_events = + crate::l7::middleware::middleware_finding_events(&preflight.findings); if !preflight.allowed { - emit_http_response_middleware_invocations( + preflight_events.extend(http_response_decision_events( middleware.policy_name, &middleware.target, status_code, &preflight.invocations, - ); + )); + if preflight.denial.is_none() { + preflight_events.push(http_response_middleware_failure_event( + middleware.policy_name, + &middleware.target, + status_code, + false, + )); + } + } + crate::telemetry::emit_decision(preflight_events, None, !preflight.allowed); + if !preflight.allowed { if let Some(denial) = preflight.denial.as_ref() { send_response_middleware_denial( client, @@ -428,12 +438,6 @@ where ) .await?; } else { - emit_http_response_middleware_failure( - middleware.policy_name, - &middleware.target, - status_code, - false, - ); send_response_delivery_failure( client, request_method, @@ -487,6 +491,8 @@ where &middleware.target, status_code, &error.diagnostics, + true, + Some(false), ); send_response_delivery_failure( client, @@ -509,7 +515,7 @@ where &finish.invocations, ); for event in crate::l7::middleware::middleware_finding_events(&finish.findings) { - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); } if finish.strip_stale_integrity_headers { strip_response_integrity_headers(&mut headers); @@ -610,13 +616,21 @@ where openshell_core::proto::MiddlewareSessionEndReason::UpstreamDisconnect }; session.end(end_reason).await; + // Diagnostics from a middleware stop and its terminal finding are + // one decision. Transport/framing errors still record delivery + // failure, but do not imply an enforced middleware refusal. + let empty_diagnostics = + openshell_supervisor_middleware::HttpResponseDiagnostics::default(); + emit_http_response_diagnostics( + middleware.policy_name, + &middleware.target, + status_code, + middleware_stop.map_or(&empty_diagnostics, |stop| &stop.diagnostics), + middleware_stop.is_some(), + (committed || middleware_stop.is_none_or(|stop| stop.failure.denial.is_none())) + .then_some(committed), + ); if committed { - emit_http_response_middleware_failure( - middleware.policy_name, - &middleware.target, - status_code, - true, - ); return Err(error); } debug!(error = %error, "HTTP response processing failed before commitment"); @@ -630,12 +644,6 @@ where ) .await?; } else { - emit_http_response_middleware_failure( - middleware.policy_name, - &middleware.target, - status_code, - false, - ); send_response_delivery_failure( client, request_method, @@ -665,14 +673,10 @@ where &middleware.target, status_code, &error.diagnostics, + true, + (committed || error.denial.is_none()).then_some(committed), ); if committed { - emit_http_response_middleware_failure( - middleware.policy_name, - &middleware.target, - status_code, - true, - ); return Err(miette!( "HTTP response middleware failed after commitment: {error}" )); @@ -688,12 +692,6 @@ where ) .await?; } else { - emit_http_response_middleware_failure( - middleware.policy_name, - &middleware.target, - status_code, - false, - ); send_response_delivery_failure( client, request_method, @@ -715,7 +713,7 @@ where &finish.invocations, ); for event in crate::l7::middleware::middleware_finding_events(&finish.findings) { - openshell_ocsf::ocsf_emit!(event); + crate::telemetry::egress_emit!(event); } if whole_body && !committed { @@ -861,29 +859,40 @@ where }) } +fn http_response_decision_events( + policy_name: &str, + target: &HttpRequestTarget, + status_code: u16, + invocations: &[openshell_supervisor_middleware::HttpResponseInvocation], +) -> Vec { + let mut events = + http_response_middleware_invocation_events(policy_name, target, status_code, invocations); + for invocation in invocations { + events.extend(http_response_middleware_fail_open_finding_event( + policy_name, + target, + invocation, + )); + events.extend(http_response_middleware_block_finding_event( + policy_name, + target, + invocation, + )); + } + events +} + fn emit_http_response_middleware_invocations( policy_name: &str, target: &HttpRequestTarget, status_code: u16, invocations: &[openshell_supervisor_middleware::HttpResponseInvocation], ) { - for event in - http_response_middleware_invocation_events(policy_name, target, status_code, invocations) - { - openshell_ocsf::ocsf_emit!(event); - } - for invocation in invocations { - if let Some(event) = - http_response_middleware_fail_open_finding_event(policy_name, target, invocation) - { - openshell_ocsf::ocsf_emit!(event); - } - if let Some(event) = - http_response_middleware_block_finding_event(policy_name, target, invocation) - { - openshell_ocsf::ocsf_emit!(event); - } - } + crate::telemetry::emit_decision( + http_response_decision_events(policy_name, target, status_code, invocations), + None, + false, + ); } fn emit_http_response_diagnostics( @@ -891,16 +900,23 @@ fn emit_http_response_diagnostics( target: &HttpRequestTarget, status_code: u16, diagnostics: &openshell_supervisor_middleware::HttpResponseDiagnostics, + denied: bool, + terminal_failure: Option, ) { - emit_http_response_middleware_invocations( - policy_name, - target, - status_code, - &diagnostics.invocations, - ); - for event in crate::l7::middleware::middleware_finding_events(&diagnostics.findings) { - openshell_ocsf::ocsf_emit!(event); + let mut events = + http_response_decision_events(policy_name, target, status_code, &diagnostics.invocations); + events.extend(crate::l7::middleware::middleware_finding_events( + &diagnostics.findings, + )); + if let Some(committed) = terminal_failure { + events.push(http_response_middleware_failure_event( + policy_name, + target, + status_code, + committed, + )); } + crate::telemetry::emit_decision(events, None, denied); } pub(super) fn http_response_middleware_invocation_events( @@ -1068,8 +1084,26 @@ fn emit_http_response_middleware_failure( status_code: u16, committed: bool, ) { + crate::telemetry::emit_decision( + [http_response_middleware_failure_event( + policy_name, + target, + status_code, + committed, + )], + None, + true, + ); +} + +fn http_response_middleware_failure_event( + policy_name: &str, + target: &HttpRequestTarget, + status_code: u16, + committed: bool, +) -> openshell_ocsf::OcsfEvent { let status_code = status_code.to_string(); - let event = openshell_ocsf::DetectionFindingBuilder::new(ocsf_ctx()) + openshell_ocsf::DetectionFindingBuilder::new(ocsf_ctx()) .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.middleware.http_response_failure", @@ -1093,8 +1127,7 @@ fn emit_http_response_middleware_failure( } else { "HTTP response middleware failed before response commitment" }) - .build(); - openshell_ocsf::ocsf_emit!(event); + .build() } #[derive(Debug)] @@ -1627,11 +1660,18 @@ struct ResponseOutputState<'a> { #[derive(Debug)] struct ResponseMiddlewareStop { failure: openshell_supervisor_middleware::HttpResponseMiddlewareFailure, + diagnostics: openshell_supervisor_middleware::HttpResponseDiagnostics, } impl ResponseMiddlewareStop { - fn new(failure: openshell_supervisor_middleware::HttpResponseMiddlewareFailure) -> Self { - Self { failure } + fn new( + failure: openshell_supervisor_middleware::HttpResponseMiddlewareFailure, + diagnostics: openshell_supervisor_middleware::HttpResponseDiagnostics, + ) -> Self { + Self { + failure, + diagnostics, + } } } @@ -1676,13 +1716,17 @@ async fn expire_whole_body_deadline( guard.ensure_current()?; } let diagnostics = session.take_diagnostics(); - emit_http_response_diagnostics( - framing.policy_name, - framing.target, - framing.status_code, - &diagnostics, - ); - let output = output.map_err(ResponseMiddlewareStop::new)?; + if output.is_ok() { + emit_http_response_diagnostics( + framing.policy_name, + framing.target, + framing.status_code, + &diagnostics, + false, + None, + ); + } + let output = output.map_err(|failure| ResponseMiddlewareStop::new(failure, diagnostics))?; deliver_response_units(client, output, framing, session.requires_whole_body()).await } @@ -1818,13 +1862,17 @@ async fn process_response_unit( guard.ensure_current()?; } let diagnostics = session.take_diagnostics(); - emit_http_response_diagnostics( - framing.policy_name, - framing.target, - framing.status_code, - &diagnostics, - ); - let output = output.map_err(ResponseMiddlewareStop::new)?; + if output.is_ok() { + emit_http_response_diagnostics( + framing.policy_name, + framing.target, + framing.status_code, + &diagnostics, + false, + None, + ); + } + let output = output.map_err(|failure| ResponseMiddlewareStop::new(failure, diagnostics))?; deliver_response_units(client, output, framing, session.requires_whole_body()).await } @@ -2081,6 +2129,131 @@ pub(super) fn response_is_event_stream(headers: &str) -> bool { #[cfg(test)] mod tests { + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_denial_and_companion_findings_share_one_trace() { + use crate::telemetry::tests::{assert_deny_resolves, exported}; + use openshell_supervisor_middleware::HttpResponseInvocationOutcome; + + let (events, received) = exported("warn", || { + let diagnostics = openshell_supervisor_middleware::HttpResponseDiagnostics { + invocations: vec![openshell_supervisor_middleware::HttpResponseInvocation { + config_name: "guard".to_string(), + implementation: "test/guard".to_string(), + outcome: HttpResponseInvocationOutcome::BlockDelivery, + sequence: None, + input_size: 0, + output_size: None, + failed: false, + stage_disabled: false, + reason_code: None, + failure_category: None, + }], + findings: vec![openshell_supervisor_middleware::NamespacedFinding { + middleware: "guard".to_string(), + finding: openshell_core::proto::Finding { + r#type: "test.finding".to_string(), + label: "Test finding".to_string(), + count: 1, + severity: "high".to_string(), + ..Default::default() + }, + }], + ..Default::default() + }; + super::emit_http_response_diagnostics( + "response-policy", + &super::HttpRequestTarget::default(), + 200, + &diagnostics, + true, + None, + ); + }) + .await; + assert!(events.len() >= 2); + assert_eq!(received.spans.len(), 1); + assert!( + events + .iter() + .all(|event| event["trace"]["uid"] == events[0]["trace"]["uid"]) + ); + assert_deny_resolves(&events, &received, true); + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_terminal_failure_without_diagnostics_still_exports_a_deny_trace() { + use crate::telemetry::tests::{assert_deny_resolves, exported}; + + // Exercise the emission boundary directly: platform refusals can lack + // invocation diagnostics, but must retain their terminal failure record. + for committed in [false, true] { + let (events, received) = exported("warn", || { + super::emit_http_response_diagnostics( + "response-policy", + &super::HttpRequestTarget::default(), + 200, + &openshell_supervisor_middleware::HttpResponseDiagnostics::default(), + true, + Some(committed), + ); + }) + .await; + + assert_eq!(events.len(), 1, "only the terminal failure is emitted"); + assert_eq!( + events[0]["finding_info"]["uid"], + "openshell.middleware.http_response_failure" + ); + assert_eq!(received.spans.len(), 1); + assert_deny_resolves(&events, &received, true); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn response_diagnostic_findings_create_deny_spans_only_when_delivery_is_denied() { + use crate::telemetry::tests::{assert_deny_resolves, exported}; + + for denied in [false, true] { + let (events, received) = exported("warn", || { + let diagnostics = openshell_supervisor_middleware::HttpResponseDiagnostics { + findings: vec![openshell_supervisor_middleware::NamespacedFinding { + middleware: "content-guard".into(), + finding: openshell_core::proto::Finding { + r#type: "test.finding".into(), + label: "Test finding".into(), + count: 1, + severity: "high".into(), + ..Default::default() + }, + }], + ..Default::default() + }; + super::emit_http_response_diagnostics( + "response-policy", + &super::HttpRequestTarget::default(), + 200, + &diagnostics, + denied, + None, + ); + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert_eq!(events.len(), 1); + if denied { + assert_deny_resolves(&events, &received, true); + } else { + assert!(events[0].get("trace").is_none()); + assert!( + !received + .spans + .iter() + .any(|span| span.name == "supervisor.egress.deny") + ); + } + } + } + use super::{ ResponseFraming, parse_connection_keep_alive, parse_response_head_for_middleware, response_is_http_10, serialize_response_head, diff --git a/crates/openshell-supervisor-network/src/l7/token_grant_injection.rs b/crates/openshell-supervisor-network/src/l7/token_grant_injection.rs index 65d7b70d08..f868575097 100644 --- a/crates/openshell-supervisor-network/src/l7/token_grant_injection.rs +++ b/crates/openshell-supervisor-network/src/l7/token_grant_injection.rs @@ -22,12 +22,13 @@ use openshell_core::token_grant_failure::{ }; use openshell_ocsf::{ ActionId, ActivityId, DispositionId, Endpoint, HttpActivityBuilder, HttpRequest, SeverityId, - StatusId, ctx::ctx as ocsf_ctx, ocsf_emit, + StatusId, ctx::ctx as ocsf_ctx, }; use tracing::warn; use crate::l7::provider::L7Request; use crate::l7::relay::L7EvalContext; +use crate::telemetry::egress_emit; /// Borrowed grant configuration for one endpoint-bound provider credential. pub struct TokenGrantRequest<'a> { @@ -340,7 +341,7 @@ fn report_refused_grant( .map_or_else(|| "none".to_string(), |status| status.to_string()), "Token grant failed" ); - ocsf_emit!( + egress_emit!( HttpActivityBuilder::new(ocsf_ctx()) .activity(ActivityId::Fail) .action(ActionId::Denied) @@ -398,7 +399,7 @@ async fn inject_selected( inject_header(&raw_header, &name, &value).map_err(TokenGrantInjectionError::new)?; } for (provider_key, _) in credentials { - ocsf_emit!( + egress_emit!( HttpActivityBuilder::new(ocsf_ctx()) .activity(ActivityId::Other) .action(ActionId::Allowed) diff --git a/crates/openshell-supervisor-network/src/l7/websocket.rs b/crates/openshell-supervisor-network/src/l7/websocket.rs index 5370e383c3..9f34e2388c 100644 --- a/crates/openshell-supervisor-network/src/l7/websocket.rs +++ b/crates/openshell-supervisor-network/src/l7/websocket.rs @@ -9,13 +9,13 @@ use crate::l7::relay::{L7EvalContext, evaluate_l7_request}; use crate::l7::{EnforcementMode, L7RequestInfo}; use crate::opa::{PolicyGenerationGuard, TunnelPolicyEngine}; +use crate::telemetry::egress_emit; use flate2::{Compress, Compression, Decompress, FlushCompress, FlushDecompress, Status}; use miette::{IntoDiagnostic, Result, miette}; use openshell_core::provider_credentials::ProviderCredentialState; use openshell_core::secrets::{SecretResolver, contains_reserved_credential_marker}; use openshell_ocsf::{ ActionId, ActivityId, DispositionId, Endpoint, NetworkActivityBuilder, SeverityId, StatusId, - ocsf_emit, }; use std::collections::HashMap; use std::future::Future; @@ -584,7 +584,7 @@ where if let Err(termination) = &result { let error = termination.error.to_string(); if error.contains(CREDENTIAL_PLACEMENT_MISMATCH) { - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Fail) .action(ActionId::Denied) @@ -597,7 +597,7 @@ where .status_detail("credential_placement_mismatch") .build() ); - ocsf_emit!(crate::l7::build_credential_placement_mismatch_finding( + egress_emit!(crate::l7::build_credential_placement_mismatch_finding( options.policy_name, host, Some("websocket"), @@ -641,27 +641,26 @@ async fn write_policy_violation_close(writer: &mut W) -> } fn emit_credential_endpoint_mismatch(host: &str, port: u16, policy_name: &str) { - ocsf_emit!( - NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .action(ActionId::Denied) - .disposition(DispositionId::Blocked) - .severity(SeverityId::High) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(host, port)) - .firewall_rule(policy_name, "credential-binding") - .message(format!( - "WebSocket credential use denied: credential is not authorized for {host}:{port}" - )) - .status_detail("credential_endpoint_mismatch") - .build() - ); - ocsf_emit!(crate::l7::build_credential_endpoint_mismatch_finding( + let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Fail) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) + .severity(SeverityId::High) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(host, port)) + .firewall_rule(policy_name, "credential-binding") + .message(format!( + "WebSocket credential use denied: credential is not authorized for {host}:{port}" + )) + .status_detail("credential_endpoint_mismatch") + .build(); + let finding = crate::l7::build_credential_endpoint_mismatch_finding( policy_name, host, Some("websocket"), "Provider credential endpoint binding mismatch; WebSocket closed", - )); + ); + crate::telemetry::emit_decision([event, finding], None, false); } async fn relay_client_to_server( @@ -1412,8 +1411,31 @@ fn emit_uninspected_credential_denial(host: &str, port: u16, policy_name: &str, "WebSocket credential traffic denied for {host}:{port}" )) .build(); - ocsf_emit!(event); - crate::l7::emit_uninspected_credential_finding(host, policy_name, surface); + let finding = crate::l7::build_uninspected_credential_finding(host, policy_name, surface); + crate::telemetry::emit_decision([event, finding], None, false); +} + +#[cfg(test)] +mod trace_tests { + use super::*; + use crate::telemetry::tests::{assert_deny_resolves, exported}; + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn paired_websocket_credential_denial_shares_one_deny_span() { + let (events, received) = exported("warn", || { + emit_uninspected_credential_denial( + "blocked.example", + 443, + "credential-policy", + "websocket", + ); + }) + .await; + assert_eq!(events.len(), 2); + assert_eq!(received.spans.len(), 1); + assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); + assert_deny_resolves(&events, &received, true); + } } fn inspect_websocket_text_message( @@ -2087,7 +2109,7 @@ fn emit_rewrite_event(host: &str, port: u16, policy_name: &str, replacements: us .firewall_rule(policy_name, "l7-websocket") .message(rewrite_event_message(host, port, replacements)) .build(); - ocsf_emit!(event); + egress_emit!(event); } fn rewrite_event_message(host: &str, port: u16, replacements: usize) -> String { @@ -2140,7 +2162,7 @@ fn emit_websocket_l7_event( request_info.action, request_info.target, summary )) .build(); - ocsf_emit!(event); + egress_emit!(event); } fn observe_termination( @@ -2153,7 +2175,7 @@ fn observe_termination( emit_protocol_failure(host, port, policy_name, failure_class); } if termination.cause == WebSocketTerminationCause::CapacityExhausted { - ocsf_emit!( + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -2177,7 +2199,7 @@ fn emit_protocol_failure( policy_name: &str, failure_class: FrameFailureClass, ) { - ocsf_emit!(protocol_failure_event( + egress_emit!(protocol_failure_event( host, port, policy_name, diff --git a/crates/openshell-supervisor-network/src/lib.rs b/crates/openshell-supervisor-network/src/lib.rs index d9fcd004b6..74a6698b92 100644 --- a/crates/openshell-supervisor-network/src/lib.rs +++ b/crates/openshell-supervisor-network/src/lib.rs @@ -24,6 +24,7 @@ pub mod proxy; pub mod run; pub mod sigv4; mod spiffe_endpoint; +mod telemetry; mod token_grant; pub mod upstream_proxy; diff --git a/crates/openshell-supervisor-network/src/policy_dns/mod.rs b/crates/openshell-supervisor-network/src/policy_dns/mod.rs index 5ddbd25cf4..4d5b61895d 100644 --- a/crates/openshell-supervisor-network/src/policy_dns/mod.rs +++ b/crates/openshell-supervisor-network/src/policy_dns/mod.rs @@ -35,10 +35,11 @@ pub(crate) use store::{ use crate::opa::OpaEngine; use crate::proxy::destination::{build_validation_plan, filter_resolved_addresses}; use crate::proxy::is_host_gateway_alias; +use crate::telemetry::egress_emit; use openshell_core::host_pattern::HostSelector; use openshell_ocsf::{ ActionId, ActivityId, ConfigStateChangeBuilder, DispositionId, Endpoint, - NetworkActivityBuilder, SeverityId, StateId, StatusId, ocsf_emit, + NetworkActivityBuilder, SeverityId, StateId, StatusId, }; use sha2::{Digest, Sha256}; use std::sync::Arc; @@ -493,7 +494,7 @@ fn dns_query_endpoint(name: &NormalizedName) -> Endpoint { } fn emit_dns_denial(name: &NormalizedName, detail: &str, message: &str) { - ocsf_emit!(build_dns_denial_event(name, detail, message)); + egress_emit!(build_dns_denial_event(name, detail, message)); } fn build_dns_denial_event( @@ -580,7 +581,7 @@ fn emit_dns_failure( detail: &str, message: &str, ) { - ocsf_emit!(build_dns_failure_event( + egress_emit!(build_dns_failure_event( name, family, eligible_endpoints, @@ -591,11 +592,11 @@ fn emit_dns_failure( } fn emit_mapping_publication(record: &ResolvedEndpointRecord) { - ocsf_emit!(build_mapping_publication_event(record)); + egress_emit!(build_mapping_publication_event(record)); } fn emit_observation_publication(record: &ResolvedEndpointRecord) { - ocsf_emit!(build_observation_publication_event(record)); + egress_emit!(build_observation_publication_event(record)); } fn build_observation_publication_event( diff --git a/crates/openshell-supervisor-network/src/proxy.rs b/crates/openshell-supervisor-network/src/proxy.rs index 85196d9f44..de09b439ea 100644 --- a/crates/openshell-supervisor-network/src/proxy.rs +++ b/crates/openshell-supervisor-network/src/proxy.rs @@ -8,6 +8,8 @@ mod egress; mod relay; #[cfg(test)] pub(crate) use relay::relay_inspected_http_stream_for_test; +#[cfg(test)] +mod trace_tests; #[cfg(test)] use openshell_sandbox_backend::test_support as rpc_test; @@ -19,6 +21,7 @@ use crate::policy_dns::{ MappingLookup, MappingLookupError, PolicyEndpointId, ResolvedEndpointStore, }; use crate::policy_local::{POLICY_LOCAL_HOST, PolicyLocalContext}; +use crate::telemetry::egress_emit; use crate::upstream_proxy::{self, UpstreamProxyConfig}; use futures::{FutureExt as _, StreamExt as _, stream::FuturesUnordered}; use http::StatusCode; @@ -44,7 +47,7 @@ use openshell_isolation_interface::contract::{ use openshell_ocsf::{ ActionId, ActivityId, BaseEventBuilder, DispositionId, Endpoint, HttpActivityBuilder, HttpRequest, HttpResponse, NetworkActivityBuilder, Process, SeverityId, StatusId, - Url as OcsfUrl, ocsf_emit, + Url as OcsfUrl, }; use openshell_sandbox_backend::NetworkMediationSource; use std::future::Future; @@ -246,14 +249,13 @@ fn build_credential_endpoint_mismatch_event( fn emit_credential_endpoint_mismatch(method: &str, host: &str, port: u16, policy_name: &str) { let event = build_credential_endpoint_mismatch_event(method, host, port, policy_name); - ocsf_emit!(event); let finding = crate::l7::build_credential_endpoint_mismatch_finding( policy_name, host, None, "Provider credential endpoint binding mismatch; request denied", ); - ocsf_emit!(finding); + crate::telemetry::emit_decision([event, finding], None, false); } /// Hostnames injected by compute drivers as `/etc/hosts` aliases for the host @@ -349,7 +351,7 @@ impl ProxyHandle { format!("Proxy listening on {local_addr}") }) .build(); - ocsf_emit!(event); + egress_emit!(event); } // Detect the trusted host gateway IP from /etc/hosts before user code @@ -390,7 +392,7 @@ impl ProxyHandle { refusing to start: {err}" )) .build(); - ocsf_emit!(event); + egress_emit!(event); miette::miette!("invalid upstream corporate proxy configuration: {err}") })?, ); @@ -404,7 +406,7 @@ impl ProxyHandle { cfg.summary() )) .build(); - ocsf_emit!(event); + egress_emit!(event); } let (exited_tx, exited_rx) = tokio::sync::oneshot::channel::<()>(); @@ -574,7 +576,7 @@ impl ProxyHandle { ) .await { - ocsf_emit!(build_proxy_connection_error_event( + egress_emit!(build_proxy_connection_error_event( peer_addr, transparent_destination_addr, format!("Proxy connection error: {err}"), @@ -583,7 +585,7 @@ impl ProxyHandle { }); } Err(ProxyAcceptError::Source(err)) => { - ocsf_emit!(build_mediation_lane_failure_event(format!( + egress_emit!(build_mediation_lane_failure_event(format!( "Network-mediation source failed; proxy accept loop exiting: {err}" ))); break; @@ -594,7 +596,7 @@ impl ProxyHandle { &mut consecutive_resource_errors, &mut consecutive_unknown_errors, ); - ocsf_emit!(build_accept_error_event(local_addr, &err, &action)); + egress_emit!(build_accept_error_event(local_addr, &err, &action)); match action { AcceptAction::Terminal => break, AcceptAction::Retry { backoff, .. } => { @@ -725,6 +727,7 @@ async fn preauthorize_transparent_open( if destination.ip() == IpAddr::V4(crate::policy_dns::POLICY_LOCAL_ADDRESS) { if destination.port() != 80 || !has_policy_local { emit_staged_transparent_denial( + None, destination, None, &binary_identity, @@ -749,6 +752,7 @@ async fn preauthorize_transparent_open( }); if let Err(denial) = identity_check { emit_staged_transparent_denial( + None, destination, None, &binary_identity, @@ -778,6 +782,7 @@ async fn preauthorize_transparent_open( Err(error) => { warn!(%destination, %error, "Denied staged transparent connection"); emit_staged_transparent_denial( + None, destination, None, &binary_identity, @@ -816,6 +821,7 @@ async fn preauthorize_transparent_open( ); warn!(%destination, %reason, "Denied staged transparent connection"); emit_staged_transparent_denial( + Some(&connect_span), destination, mapped_host, &binary_identity, @@ -844,6 +850,7 @@ async fn preauthorize_transparent_open( { warn!(%destination, reason = %denial.reason, "Denied staged transparent destination"); emit_staged_transparent_denial( + Some(&connect_span), destination, mapped_host, &binary_identity, @@ -882,6 +889,7 @@ async fn preauthorize_transparent_open( }; warn!(%destination, %reason, "Denied staged transparent connection"); emit_staged_transparent_denial( + Some(&connect_span), destination, mapped_host, &binary_identity, @@ -914,6 +922,7 @@ async fn preauthorize_transparent_open( Err(denial) => { warn!(%destination, reason = %denial.reason, "Denied staged transparent destination"); emit_staged_transparent_denial( + Some(&connect_span), destination, mapped_host, &binary_identity, @@ -940,13 +949,14 @@ async fn preauthorize_transparent_open( } fn emit_staged_transparent_denial( + parent: Option<&tracing::Span>, destination: SocketAddr, mapped_host: Option<&str>, identity: &Result, reason: &str, status_detail: &'static str, ) { - ocsf_emit!(build_staged_transparent_denial_event( + egress_emit!(optional_deny_parent: parent, build_staged_transparent_denial_event( destination, mapped_host, identity, @@ -1180,7 +1190,7 @@ impl TransparentTcpHandle { ) .await { - ocsf_emit!(build_connection_error_event( + egress_emit!(build_connection_error_event( peer_addr, format!("Transparent TCP connection error: {error}") )); @@ -1226,7 +1236,7 @@ async fn handle_transparent_tcp_connection( ) { Ok(mapping) => mapping, Err(error) => { - emit_transparent_mapping_denial(workload_addr, original, None, error); + emit_transparent_mapping_denial(None, workload_addr, original, None, error); emit_activity(&activity_tx, true, "transparent_tcp_mapping"); return Ok(()); } @@ -1247,7 +1257,7 @@ async fn handle_transparent_tcp_connection( .map_err(|error| miette::miette!("identity resolution task panicked: {error}"))?; if let NetworkAction::Deny { reason } = &decision.action { - emit_transparent_policy_denial(&decision, workload_addr, &host, port); + emit_transparent_policy_denial(&connect_span, &decision, workload_addr, &host, port); emit_denial( &denial_tx, &host, @@ -1266,6 +1276,7 @@ async fn handle_transparent_tcp_connection( if mapping.record.is_observation() { emit_transparent_mapping_denial( + Some(&connect_span), workload_addr, original, Some(&host), @@ -1284,6 +1295,7 @@ async fn handle_transparent_tcp_connection( relay::pin_policy_generation(&opa_engine, decision.policy_generation) else { emit_transparent_mapping_denial( + Some(&connect_span), workload_addr, original, Some(&host), @@ -1300,7 +1312,13 @@ async fn handle_transparent_tcp_connection( ) { Ok(mapping) => mapping, Err(error) => { - emit_transparent_mapping_denial(workload_addr, original, Some(&host), error); + emit_transparent_mapping_denial( + Some(&connect_span), + workload_addr, + original, + Some(&host), + error, + ); emit_activity(&activity_tx, true, "transparent_tcp_mapping"); return Ok(()); } @@ -1317,7 +1335,7 @@ async fn handle_transparent_tcp_connection( .find(|candidate| mapping.endpoint_ids().any(|mapped| mapped == candidate)); let Some(endpoint_id) = endpoint_id else { let reason = "authorized endpoint did not match DNS correlation"; - emit_transparent_policy_denial(&decision, workload_addr, &host, port); + emit_transparent_policy_denial(&connect_span, &decision, workload_addr, &host, port); emit_denial( &denial_tx, &host, @@ -1357,7 +1375,9 @@ async fn handle_transparent_tcp_connection( ); let middleware_gate = middleware_uninspectable_gate(&opa_engine, &ctx)?; if middleware_gate == crate::l7::middleware::UninspectableTrafficGate::Deny { - crate::l7::middleware::emit_middleware_uninspectable(&ctx, "transparent tcp", true); + connect_span.in_scope(|| { + crate::l7::middleware::emit_middleware_uninspectable(&ctx, "transparent tcp", true); + }); return Ok(()); } if middleware_gate == crate::l7::middleware::UninspectableTrafficGate::BypassWithFinding { @@ -1373,7 +1393,6 @@ async fn handle_transparent_tcp_connection( .inspect_err(|_| egress::mark_error(&dial_span)) .into_diagnostic()?; drop(dial_span); - drop(connect_span); let upstream_socket_peer = upstream.peer_addr().into_diagnostic()?; let (connected_real_destination, dial_mode) = match upstream.connect_target() { Some(upstream_proxy::ConnectTarget::Ip(ip)) => ( @@ -1385,7 +1404,7 @@ async fn handle_transparent_tcp_connection( // validated address set. A hostname-mode CONNECT would make the // corporate proxy resolve again and break that binding. Treat a // future invariant regression as an audited denial, not a panic. - emit_transparent_policy_denial(&decision, workload_addr, &host, port); + emit_transparent_policy_denial(&connect_span, &decision, workload_addr, &host, port); emit_denial( &denial_tx, &host, @@ -1416,7 +1435,8 @@ async fn handle_transparent_tcp_connection( let pid = decision .binary_pid .map_or_else(|| "-".to_string(), |pid| pid.to_string()); - ocsf_emit!(build_transparent_tcp_allow_ocsf_event( + drop(connect_span); + egress_emit!(build_transparent_tcp_allow_ocsf_event( TransparentTcpAllowAudit { workload: workload_addr, synthetic_destination: original, @@ -1546,6 +1566,7 @@ fn original_destination(stream: &TcpStream) -> std::io::Result { #[cfg(target_os = "linux")] fn emit_transparent_mapping_denial( + parent: Option<&tracing::Span>, workload: SocketAddr, original: SocketAddr, mapped_host: Option<&str>, @@ -1560,7 +1581,7 @@ fn emit_transparent_mapping_denial( | MappingLookupError::InvalidMapping | MappingLookupError::LockPoisoned => "transparent_tcp_destination_denied", }; - ocsf_emit!( + egress_emit!(optional_deny_parent: parent, NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -1577,6 +1598,7 @@ fn emit_transparent_mapping_denial( #[cfg(target_os = "linux")] fn emit_transparent_policy_denial( + parent: &tracing::Span, decision: &EgressDecision, workload: SocketAddr, host: &str, @@ -1594,7 +1616,7 @@ fn emit_transparent_policy_denial( let pid = decision .binary_pid .map_or_else(|| "-".to_string(), |pid| pid.to_string()); - ocsf_emit!( + egress_emit!(deny_parent: parent, NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -1821,6 +1843,52 @@ fn unsupported_l7_tunnel_protocol_detail( } } +#[allow(clippy::too_many_arguments)] +fn build_unsupported_connect_protocol_event( + peer_addr: SocketAddr, + host: &str, + port: u16, + binary: &str, + pid: &str, + ancestors: &str, + cmdline: &str, + policy: &str, + detail: &str, +) -> openshell_ocsf::OcsfEvent { + NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Open) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) + .severity(SeverityId::Medium) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(host, port)) + .src_endpoint_addr(peer_addr.ip(), peer_addr.port()) + .actor_process(Process::from_bypass(binary, pid, ancestors).with_cmd_line(cmdline)) + .firewall_rule(policy, "l7") + .message(format!( + "CONNECT_L7 blocked unsupported tunnel protocol for {host}:{port}" + )) + .status_detail(detail) + .build() +} + +fn emit_unsupported_connect_protocol( + ctx: &crate::l7::relay::L7EvalContext, + requirement: InspectionRequirement, + detail: &str, + event: openshell_ocsf::OcsfEvent, +) { + // Both records describe one refusal. Use the domain event's decision + // fields for their shared scope, which exits before the response await. + let scope = crate::telemetry::deny_span(&event, None); + scope.in_scope(|| { + if requirement == InspectionRequirement::RequiredMiddleware { + crate::l7::middleware::emit_middleware_uninspectable(ctx, detail, true); + } + egress_emit!(event); + }); +} + /// Gate for traffic that would bypass L7 inspection entirely: query the /// middleware chain matching this destination and process identity, and /// decide whether raw relay is allowed. Uninspectable traffic is denied when @@ -2066,6 +2134,62 @@ fn build_forward_allow_ocsf_event( .build() } +fn build_forward_rejection_event( + host: &str, + port: u16, + message: String, +) -> openshell_ocsf::OcsfEvent { + NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Fail) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) + .severity(SeverityId::Medium) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(host, port)) + .message(message) + .build() +} + +fn build_forward_l7_evaluation_error( + host: &str, + port: u16, + enforcement: crate::l7::EnforcementMode, + error: &str, +) -> openshell_ocsf::OcsfEvent { + let enforced = enforcement == crate::l7::EnforcementMode::Enforce; + NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Fail) + .action(if enforced { + ActionId::Denied + } else { + ActionId::Other + }) + .disposition(if enforced { + DispositionId::Blocked + } else { + DispositionId::Allowed + }) + .severity(SeverityId::Low) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(host, port)) + .message(format!("L7 evaluation failed: {error}")) + .build() +} + +fn emit_forward_l7_decision( + decision: openshell_ocsf::OcsfEvent, + evaluation_error: Option, + connect_span: &tracing::Span, +) { + // The HTTP decision carries policy context that its evaluation-error + // companion lacks, so it must supply the shared deny span's attributes. + crate::telemetry::emit_decision( + std::iter::once(decision).chain(evaluation_error), + Some(connect_span), + false, + ); +} + fn build_forward_parse_error_ocsf_event( peer_addr: Option, method: &str, @@ -2080,6 +2204,8 @@ fn build_forward_parse_error_ocsf_event( .http_response(HttpResponse { code: StatusCode::BAD_REQUEST.as_u16(), }) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) .severity(SeverityId::Low) .status(StatusId::Failure) .message(format!("FORWARD parse error for {path}")); @@ -2308,6 +2434,7 @@ fn build_forward_destination_deny_ocsf_event( #[allow(clippy::too_many_arguments)] async fn deny_connect_destination( client: &mut C, + connect_span: &tracing::Span, denial: &DestinationDenial, peer_addr: SocketAddr, host: &str, @@ -2324,7 +2451,7 @@ where C: TokioAsyncWrite + Unpin, { let detail = destination_denial_detail(denial.kind); - ocsf_emit!(build_connect_destination_deny_ocsf_event( + egress_emit!(deny_parent: connect_span, build_connect_destination_deny_ocsf_event( denial, peer_addr, host, port, binary, pid, ancestors, cmdline, )); @@ -2357,6 +2484,7 @@ where #[allow(clippy::too_many_arguments)] async fn deny_forward_destination( client: &mut C, + connect_span: &tracing::Span, denial: &DestinationDenial, peer_addr: SocketAddr, method: &str, @@ -2376,7 +2504,7 @@ where C: TokioAsyncWrite + Unpin, { let detail = destination_denial_detail(denial.kind); - ocsf_emit!(build_forward_destination_deny_ocsf_event( + egress_emit!(deny_parent: connect_span, build_forward_destination_deny_ocsf_event( denial, peer_addr, method, host, port, path, binary, pid, ancestors, cmdline, policy, )); @@ -2835,7 +2963,7 @@ async fn handle_mediated_connection( .message(format!("CONNECT denied {host_lc}:{port}")) .status_detail(&deny_reason) .build(); - ocsf_emit!(event); + egress_emit!(deny_parent: &connect_span, event); emit_denial( &denial_tx, &host_lc, @@ -2908,6 +3036,7 @@ async fn handle_mediated_connection( } deny_connect_destination( &mut client, + &connect_span, &denial, workload_addr, &host_lc, @@ -2951,6 +3080,7 @@ async fn handle_mediated_connection( } deny_connect_destination( &mut client, + &connect_span, &denial, workload_addr, &host_lc, @@ -3000,7 +3130,7 @@ async fn handle_mediated_connection( )) .status_detail(TLS_TERMINATION_UNAVAILABLE_DETAIL) .build(); - ocsf_emit!(event); + egress_emit!(deny_parent: &connect_span, event); emit_activity_simple(activity_tx.as_ref(), true, "tls_termination_unavailable"); emit_denial( &denial_tx, @@ -3038,12 +3168,12 @@ async fn handle_mediated_connection( )) .status_detail(DETAIL) .build(); - ocsf_emit!(event); - crate::l7::emit_uninspected_credential_finding( + let finding = crate::l7::build_uninspected_credential_finding( &host_lc, policy_str, if effective_tls_skip { "tls-skip" } else { "l4" }, ); + crate::telemetry::emit_decision([event, finding], Some(&connect_span), false); emit_activity_simple(activity_tx.as_ref(), true, "uninspected_credentials"); emit_denial( &denial_tx, @@ -3120,7 +3250,7 @@ async fn handle_mediated_connection( // Log the allowed CONNECT — use CONNECT_L7 when L7 inspection follows, // so log consumers can distinguish L4-only decisions from tunnel lifecycle events. - ocsf_emit!(build_connect_allow_ocsf_event( + egress_emit!(build_connect_allow_ocsf_event( workload_addr, &host_lc, port, @@ -3231,7 +3361,7 @@ async fn handle_mediated_connection( .dst_endpoint(Endpoint::from_domain(&host_lc, port)) .message("Upstream TLS establishment failed") .build(); - ocsf_emit!(event); + egress_emit!(event); return Err(error); } }; @@ -3260,7 +3390,7 @@ async fn handle_mediated_connection( .dst_endpoint(Endpoint::from_domain(&host_lc, port)) .message(format!("TLS relay error: {e}")) .build(); - ocsf_emit!(event); + egress_emit!(event); } } } else { @@ -3292,7 +3422,7 @@ async fn handle_mediated_connection( .message(format!("CONNECT refused for {host_lc}:{port}: {DETAIL}")) .status_detail(DETAIL) .build(); - ocsf_emit!(event); + egress_emit!(event); emit_activity_simple(activity_tx.as_ref(), true, "tls_termination_unavailable"); emit_denial( &denial_tx, @@ -3335,7 +3465,7 @@ async fn handle_mediated_connection( .dst_endpoint(Endpoint::from_domain(&host_lc, port)) .message(message) .build(); - ocsf_emit!(event); + egress_emit!(event); } } } else { @@ -3344,28 +3474,18 @@ async fn handle_mediated_connection( if let Some(protocol_detail) = unsupported_l7_tunnel_protocol_detail(tunnel_protocol, requirement) { - if requirement == InspectionRequirement::RequiredMiddleware { - crate::l7::middleware::emit_middleware_uninspectable(&ctx, protocol_detail, true); - } - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Open) - .action(ActionId::Denied) - .disposition(DispositionId::Blocked) - .severity(SeverityId::Medium) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(&host_lc, port)) - .src_endpoint_addr(workload_addr.ip(), workload_addr.port()) - .actor_process( - Process::from_bypass(&binary_str, &pid_str, &ancestors_str) - .with_cmd_line(&cmdline_str), - ) - .firewall_rule(policy_str, "l7") - .message(format!( - "CONNECT_L7 blocked unsupported tunnel protocol for {host_lc}:{port}" - )) - .status_detail(protocol_detail) - .build(); - ocsf_emit!(event); + let event = build_unsupported_connect_protocol_event( + workload_addr, + &host_lc, + port, + &binary_str, + &pid_str, + &ancestors_str, + &cmdline_str, + policy_str, + protocol_detail, + ); + emit_unsupported_connect_protocol(&ctx, requirement, protocol_detail, event); emit_activity_simple(activity_tx.as_ref(), true, "l7_parse_rejection"); emit_denial( &denial_tx, @@ -3966,7 +4086,7 @@ fn emit_l7_tunnel_close_after_policy_change(host: &str, port: u16, error: miette "L7 tunnel closed before inspection because policy changed: {error}" )) .build(); - ocsf_emit!(event); + egress_emit!(event); } async fn reject_stale_connect_policy( @@ -4808,7 +4928,7 @@ fn parse_allowed_ips(raw: &[String]) -> std::result::Result, S n.prefix_len() )) .build(); - ocsf_emit!(event); + egress_emit!(event); } nets.push(n); } @@ -5482,7 +5602,7 @@ async fn handle_forward_proxy( // canonicalized below before credential binding, policy-path evaluation, // upstream bytes, or telemetry consume it. let Ok((scheme, host, port, mut path)) = parse_proxy_uri(target_uri) else { - ocsf_emit!(build_forward_parse_error_ocsf_event( + egress_emit!(build_forward_parse_error_ocsf_event( workload_peer_addr, method, &telemetry_path @@ -5551,7 +5671,7 @@ async fn handle_forward_proxy( if scheme != "http" { let event = build_forward_unsupported_scheme_ocsf_event(method, &scheme, &host_lc, port); - ocsf_emit!(event); + egress_emit!(event); if scheme == "https" { respond( client, @@ -5643,7 +5763,7 @@ async fn handle_forward_proxy( let matched_policy = match &decision.action { NetworkAction::Allow { matched_policy } => matched_policy.clone(), NetworkAction::Deny { reason } => { - ocsf_emit!(build_forward_policy_deny_ocsf_event( + egress_emit!(deny_parent: &connect_span, build_forward_policy_deny_ocsf_event( workload_addr, method, &host_lc, @@ -5754,16 +5874,12 @@ async fn handle_forward_proxy( let prepared_target = match prepare_forward_target(&path, canonicalize_options) { Ok(prepared) => prepared, Err(error) => { - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .severity(SeverityId::Medium) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(&host_lc, port)) - .message(format!( - "FORWARD rejecting non-canonical request-target: {error}" - )) - .build(); - ocsf_emit!(event); + let event = build_forward_rejection_event( + &host_lc, + port, + format!("FORWARD rejecting non-canonical request-target: {error}"), + ); + egress_emit!(deny_parent: &connect_span, event); emit_activity_simple(activity_tx, true, "forward_parse_rejection"); respond( client, @@ -5916,7 +6032,7 @@ async fn handle_forward_proxy( if !l7_config.config.allow_encoded_slash && crate::l7::path::canonical_path_has_encoded_slash(&path) { - ocsf_emit!(build_forward_l7_parse_rejection_ocsf_event( + egress_emit!(deny_parent: &connect_span, build_forward_l7_parse_rejection_ocsf_event( workload_addr, method, &host_lc, @@ -5973,7 +6089,7 @@ async fn handle_forward_proxy( )) .status_detail(upgrade_detail) .build(); - ocsf_emit!(event); + egress_emit!(deny_parent: &connect_span, event); emit_activity_simple(activity_tx, true, "l7_parse_rejection"); emit_denial_simple( denial_tx, @@ -6031,14 +6147,12 @@ async fn handle_forward_proxy( { Ok(info) => info, Err(e) => { - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .severity(SeverityId::Medium) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(&host_lc, port)) - .message(format!("FORWARD_GRAPHQL_L7 request rejected: {e}")) - .build(); - ocsf_emit!(event); + let event = build_forward_rejection_event( + &host_lc, + port, + format!("FORWARD_GRAPHQL_L7 request rejected: {e}"), + ); + egress_emit!(deny_parent: &connect_span, event); emit_activity_simple(activity_tx, true, "l7_parse_rejection"); respond( client, @@ -6085,14 +6199,12 @@ async fn handle_forward_proxy( { Ok(body) => body, Err(e) => { - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .severity(SeverityId::Medium) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(&host_lc, port)) - .message(format!("FORWARD_JSONRPC_L7 request rejected: {e}")) - .build(); - ocsf_emit!(event); + let event = build_forward_rejection_event( + &host_lc, + port, + format!("FORWARD_JSONRPC_L7 request rejected: {e}"), + ); + egress_emit!(deny_parent: &connect_span, event); emit_activity_simple(activity_tx, true, "l7_parse_rejection"); respond( client, @@ -6143,18 +6255,17 @@ async fn handle_forward_proxy( let hard_deny_reason = crate::l7::relay::l7_request_hard_deny_reason(l7_config.config.protocol, &request_info); let force_deny = hard_deny_reason.is_some(); + let mut evaluation_error = None; let (allowed, reason) = hard_deny_reason.map_or_else( || { crate::l7::relay::evaluate_l7_request(&tunnel_engine, &l7_ctx, &request_info) .unwrap_or_else(|e| { - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .severity(SeverityId::Low) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(&host_lc, port)) - .message(format!("L7 eval failed, denying request: {e}")) - .build(); - ocsf_emit!(event); + evaluation_error = Some(build_forward_l7_evaluation_error( + &host_lc, + port, + l7_config.config.enforcement, + &e.to_string(), + )); (false, format!("L7 evaluation error: {e}")) }) }, @@ -6230,7 +6341,7 @@ async fn handle_forward_proxy( .firewall_rule(policy_str, engine_type) .message(log_message) .build(); - ocsf_emit!(event); + emit_forward_l7_decision(event, evaluation_error, &connect_span); } let effectively_denied = force_deny @@ -6281,6 +6392,7 @@ async fn handle_forward_proxy( Err(denial) => { deny_forward_destination( client, + &connect_span, &denial, workload_addr, method, @@ -6319,6 +6431,7 @@ async fn handle_forward_proxy( Err(denial) => { deny_forward_destination( client, + &connect_span, &denial, workload_addr, method, @@ -6742,7 +6855,7 @@ async fn handle_forward_proxy( "FORWARD upstream connect failed for {host_lc}:{port}: {e}" )) .build(); - ocsf_emit!(event); + egress_emit!(deny_parent: &connect_span, event); if let Some(session) = middleware_session.take() { session .end(openshell_core::proto::MiddlewareSessionEndReason::UpstreamFailure) @@ -6872,7 +6985,7 @@ async fn handle_forward_proxy( // The request has now survived middleware, token grant, credential // rewriting, generation checks, and the HTTP relay. Only now record the // final allowed outcome. - ocsf_emit!(build_forward_allow_ocsf_event( + egress_emit!(build_forward_allow_ocsf_event( workload_addr, method, &host_lc, diff --git a/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs b/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs index 010cb466c5..95598fb8c2 100644 --- a/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs +++ b/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs @@ -89,6 +89,7 @@ async fn destination_denials_preserve_adapter_specific_wire_contracts() { let (mut app, mut proxy) = tcp_pair().await; deny_connect_destination( &mut proxy, + &tracing::Span::none(), &denial, peer, "target.example", @@ -116,6 +117,7 @@ async fn destination_denials_preserve_adapter_specific_wire_contracts() { let (mut app, mut proxy) = tcp_pair().await; deny_forward_destination( &mut proxy, + &tracing::Span::none(), &denial, peer, "POST", diff --git a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs new file mode 100644 index 0000000000..74670af9fe --- /dev/null +++ b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs @@ -0,0 +1,629 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +use super::*; +use crate::telemetry::tests::{assert_deny_resolves, exported}; +use opentelemetry_proto::tonic::common::v1::any_value::Value; + +fn emit_staged_policy_deny(debug: bool) { + let intent = EgressIntent::connect("blocked.example".to_string(), 443); + let connect = egress::connect_span(&intent); + assert_eq!(connect.is_disabled(), !debug); + connect.in_scope(|| { + egress::traced_authorization( + intent, + |intent| EgressDecision { + intent, + action: NetworkAction::Deny { + reason: "not permitted".to_string(), + }, + policy_generation: 1, + identity: ProcessIdentityEvidence::Unavailable( + IdentityUnavailableReason::LookupFailed, + ), + endpoint: EndpointDecision::default(), + binary: None, + binary_pid: None, + ancestors: vec![], + cmdline_paths: vec![], + }, + |decision| decision, + ); + }); + // Authorization has exited. The actual staged L4 emission must enter its + // own INFO deny span, retaining the saved DEBUG parent when it is enabled. + emit_staged_transparent_denial( + Some(&connect), + "192.0.2.1:443".parse().unwrap(), + Some("blocked.example"), + &Err(ResolveError::Failed("unavailable".to_string())), + "not permitted", + "transparent_tcp_policy_denied", + ); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn default_level_l4_deny_uid_resolves_to_one_span_root_trace() { + let (events, received) = exported("warn", || emit_staged_policy_deny(false)).await; + assert_eq!(events.len(), 1); + assert_deny_resolves(&events, &received, true); + assert_eq!(received.spans.len(), 1); + assert_eq!(events[0]["class_uid"], 4001); + let attributes = received.spans[0] + .attributes + .iter() + .map(|kv| { + ( + kv.key.as_str(), + kv.value.as_ref().unwrap().value.as_ref().unwrap(), + ) + }) + .collect::>(); + assert_eq!( + attributes["openshell.policy.decision"], + &Value::StringValue("deny".to_string()) + ); + assert_eq!( + attributes["server.address"], + &Value::StringValue("blocked.example".to_string()) + ); + assert_eq!(attributes["server.port"], &Value::IntValue(443)); + assert_eq!( + attributes["openshell.policy.reason"], + &Value::StringValue("transparent_tcp_policy_denied".to_string()) + ); + assert!(!attributes.contains_key("openshell.policy.name")); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn debug_level_deny_retains_connect_and_authorization_trace() { + let (events, received) = exported("debug", || emit_staged_policy_deny(true)).await; + assert_eq!(events.len(), 1); + assert_eq!( + received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .count(), + 1 + ); + assert_deny_resolves(&events, &received, false); + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + let deny = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.deny") + .unwrap(); + let authorize = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.authorize") + .unwrap(); + assert_eq!(deny.trace_id, connect.trace_id); + assert_eq!(deny.parent_span_id, connect.span_id); + assert_eq!(authorize.parent_span_id, connect.span_id); + assert_eq!(authorize.trace_id, connect.trace_id); + assert_eq!(events[0]["trace"]["uid"], hex::encode(&connect.trace_id)); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn paired_credential_denial_shares_one_deny_span() { + let (events, received) = exported("warn", || { + emit_credential_endpoint_mismatch("POST", "blocked.example", 443, "credential-policy"); + }) + .await; + assert_eq!(events.len(), 2); + assert_eq!(received.spans.len(), 1); + assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); + assert_deny_resolves(&events, &received, true); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn repeated_credential_denials_keep_decision_spans_separate() { + for level in ["warn", "debug"] { + let (events, received) = exported(level, || { + let connect = + egress::connect_span(&EgressIntent::connect("blocked.example".to_string(), 443)); + connect.in_scope(|| { + for _ in 0..2 { + emit_credential_endpoint_mismatch( + "POST", + "blocked.example", + 443, + "credential-policy", + ); + } + }); + let allowed = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(ActionId::Allowed) + .dst_endpoint(Endpoint::from_domain("allowed.example", 443)) + .build(); + crate::telemetry::emit(allowed, None, false); + }) + .await; + + assert_eq!(events.len(), 5); + assert_deny_resolves(&events[..4], &received, level == "warn"); + for pair in events[..4].chunks_exact(2) { + assert_eq!(pair[0]["trace"]["uid"], pair[1]["trace"]["uid"]); + } + assert!(events[4].get("trace").is_none(), "deny context must exit"); + let denies = received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .collect::>(); + assert_eq!(denies.len(), 2); + assert_ne!(denies[0].span_id, denies[1].span_id); + assert_eq!(received.spans.len(), if level == "debug" { 3 } else { 2 }); + if level == "debug" { + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + for deny in denies { + assert_eq!(deny.trace_id, connect.trace_id); + assert_eq!(deny.parent_span_id, connect.span_id); + } + assert_eq!(events[0]["trace"]["uid"], events[2]["trace"]["uid"]); + } else { + assert_ne!(events[0]["trace"]["uid"], events[2]["trace"]["uid"]); + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn noncanonical_forward_rejections_have_a_deny_trace() { + let (events, received) = exported("warn", || { + let Err(error) = + prepare_forward_target("/%zz", crate::l7::path::CanonicalizeOptions::default()) + else { + panic!("invalid escape must be rejected"); + }; + egress_emit!(build_forward_rejection_event( + "blocked.example", + 443, + format!("FORWARD rejecting non-canonical request-target: {error}") + )); + }) + .await; + assert_eq!(events.len(), 1); + assert_eq!(events[0]["action_id"], 2); + assert_deny_resolves(&events, &received, true); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn connect_and_forward_denials_use_the_saved_connect_parent() { + for level in ["warn", "debug"] { + for forward in [false, true] { + let (events, received) = exported(level, || { + let intent = EgressIntent::connect("blocked.example".to_string(), 443); + let connect = egress::connect_span(&intent); + let decision = EgressDecision { + intent, + action: NetworkAction::Allow { + matched_policy: None, + }, + policy_generation: 1, + identity: ProcessIdentityEvidence::Available, + endpoint: EndpointDecision::default(), + binary: None, + binary_pid: None, + ancestors: vec![], + cmdline_paths: vec![], + }; + let denial = DestinationDenial { + kind: DestinationDenialKind::InternalAddress, + reason: "private destination".to_string(), + }; + let mut output = Vec::new(); + if forward { + futures::executor::block_on(deny_forward_destination( + &mut output, + &connect, + &denial, + "127.0.0.1:41000".parse().unwrap(), + "POST", + "blocked.example", + 443, + "/", + "curl", + "42", + "-", + "curl", + "forward-policy", + &decision, + None, + None, + )) + .unwrap(); + } else { + futures::executor::block_on(deny_connect_destination( + &mut output, + &connect, + &denial, + "127.0.0.1:41000".parse().unwrap(), + "blocked.example", + 443, + "curl", + "42", + "-", + "curl", + &decision, + &None, + &None, + )) + .unwrap(); + } + assert!(output.starts_with(b"HTTP/1.1 403 Forbidden")); + }) + .await; + assert_eq!(events.len(), 1); + assert_deny_resolves(&events, &received, level == "warn"); + assert_eq!( + received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .count(), + 1 + ); + if level == "debug" { + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + let deny = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.deny") + .unwrap(); + assert_eq!(deny.parent_span_id, connect.span_id); + assert_eq!(events[0]["trace"]["uid"], hex::encode(&connect.trace_id)); + } + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn evaluation_errors_only_trace_enforced_denials() { + for mode in [ + crate::l7::EnforcementMode::Audit, + crate::l7::EnforcementMode::Enforce, + ] { + let (events, received) = exported("warn", || { + egress_emit!(build_forward_l7_evaluation_error( + "blocked.example", + 443, + mode, + "evaluation unavailable" + )); + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert_eq!(events.len(), 1); + if mode == crate::l7::EnforcementMode::Enforce { + assert_eq!(events[0]["action_id"], 2); + assert_deny_resolves(&events, &received, true); + } else { + assert!(events[0].get("trace").is_none()); + assert_eq!( + received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .count(), + 0 + ); + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn forward_evaluation_error_keeps_the_http_decision_policy_context() { + for level in ["warn", "debug"] { + for mode in [ + crate::l7::EnforcementMode::Audit, + crate::l7::EnforcementMode::Enforce, + ] { + let enforced = mode == crate::l7::EnforcementMode::Enforce; + let (events, received) = exported(level, || { + let connect = egress::connect_span(&EgressIntent::forward_http( + "blocked.example".to_string(), + 443, + )); + let decision = HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Other) + .action(if enforced { + ActionId::Denied + } else { + ActionId::Allowed + }) + .disposition(if enforced { + DispositionId::Blocked + } else { + DispositionId::Allowed + }) + .http_request(HttpRequest::new( + "GET", + OcsfUrl::new("http", "blocked.example", "/", 443), + )) + .dst_endpoint(Endpoint::from_domain("blocked.example", 443)) + .firewall_rule("forward-policy", "l7") + .build(); + let error = build_forward_l7_evaluation_error( + "blocked.example", + 443, + mode, + "evaluation unavailable", + ); + // Use the same grouping as the forward-proxy production path. + emit_forward_l7_decision(decision, Some(error), &connect); + if !enforced { + tracing::info_span!("test.export-barrier").in_scope(|| {}); + } + }) + .await; + + assert_eq!(events.len(), 2); + let http_decision = events + .iter() + .find(|event| event["class_uid"] == 4002) + .unwrap(); + let evaluation_error = events + .iter() + .find(|event| event["class_uid"] == 4001) + .unwrap(); + let denies = received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .collect::>(); + if enforced { + assert_eq!(denies.len(), 1); + assert_eq!(received.spans.len(), if level == "debug" { 2 } else { 1 }); + assert_eq!(http_decision["action_id"], 2); + assert_eq!(evaluation_error["action_id"], 2); + assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); + assert_deny_resolves(&events, &received, level == "warn"); + let attribute = |key: &str| { + denies[0] + .attributes + .iter() + .find(|attribute| attribute.key == key) + .and_then(|attribute| attribute.value.as_ref()?.value.as_ref()) + }; + assert_eq!( + attribute("openshell.policy.name"), + Some(&Value::StringValue("forward-policy".to_string())), + "the shared deny span must retain the HTTP decision's policy name" + ); + assert_eq!( + attribute("server.address"), + Some(&Value::StringValue("blocked.example".to_string())) + ); + assert_eq!(attribute("ocsf.class_uid"), Some(&Value::IntValue(4002))); + // This production decision currently has no status_detail. + assert!(attribute("openshell.policy.reason").is_none()); + if level == "debug" { + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + assert_eq!(denies[0].parent_span_id, connect.span_id); + assert_eq!(denies[0].trace_id, connect.trace_id); + } + } else { + assert!(denies.is_empty()); + assert_eq!(http_decision["action_id"], 1); + assert_eq!(evaluation_error["action_id"], 99); + for event in events { + assert!(event.get("trace").is_none()); + } + } + } + } +} + +fn unsupported_connect_context() -> crate::l7::relay::L7EvalContext { + crate::l7::relay::L7EvalContext { + host: "blocked.example".to_string(), + port: 443, + policy_name: "connect-policy".to_string(), + ..Default::default() + } +} + +fn emit_unsupported_connect_fixture( + ctx: &crate::l7::relay::L7EvalContext, + requirement: InspectionRequirement, + detail: &str, +) { + // The real CONNECT handler drops its connect span before sending the 200 + // and inspecting the tunnel payload, including when DEBUG is enabled. + drop(egress::connect_span(&EgressIntent::connect( + ctx.host.clone(), + ctx.port, + ))); + let event = build_unsupported_connect_protocol_event( + "127.0.0.1:41000".parse().unwrap(), + &ctx.host, + ctx.port, + "curl", + "42", + "-", + "curl", + &ctx.policy_name, + detail, + ); + emit_unsupported_connect_protocol(ctx, requirement, detail, event); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn unsupported_connect_required_middleware_companions_share_one_deny_scope() { + for level in ["warn", "debug"] { + for payload in [ + crate::l7::rest::HTTP2_PRIOR_KNOWLEDGE_PREFACE, + b"SSH-2.0-OpenSSH\r\n".as_slice(), + ] { + let protocol = peek_tunnel_protocol(&mut tokio::io::BufReader::new(payload)) + .await + .unwrap() + .unwrap(); + let requirement = inspection_requirement( + false, + crate::l7::middleware::UninspectableTrafficGate::Deny, + ); + assert_eq!(requirement, InspectionRequirement::RequiredMiddleware); + let detail = unsupported_l7_tunnel_protocol_detail(protocol, requirement).unwrap(); + let ctx = unsupported_connect_context(); + let (events, received) = exported(level, || { + emit_unsupported_connect_fixture(&ctx, requirement, detail); + }) + .await; + + assert_eq!(events.len(), 2, "one finding and one existing domain event"); + let denies = received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .collect::>(); + assert_eq!( + denies.len(), + 1, + "one unsupported CONNECT decision must export one deny span ({level}, {protocol:?})" + ); + assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); + assert_deny_resolves(&events, &received, true); + assert_eq!(received.spans.len(), if level == "debug" { 2 } else { 1 }); + assert_eq!(events[0]["class_uid"], 2004); + assert_eq!(events[1]["class_uid"], 4001); + assert_eq!(events[1]["action_id"], 2); + assert_eq!(events[1]["disposition_id"], 2); + assert_eq!(events[1]["status_detail"], detail); + assert_eq!(events[1]["firewall_rule"]["name"], ctx.policy_name); + let attribute = |key: &str| { + denies[0] + .attributes + .iter() + .find(|attribute| attribute.key == key) + .and_then(|attribute| attribute.value.as_ref()?.value.as_ref()) + }; + assert_eq!( + attribute("openshell.policy.name"), + Some(&Value::StringValue(ctx.policy_name.clone())) + ); + assert_eq!( + attribute("openshell.policy.reason"), + Some(&Value::StringValue(detail.to_string())) + ); + assert_eq!(attribute("ocsf.class_uid"), Some(&Value::IntValue(4001))); + assert_eq!( + attribute("server.address"), + Some(&Value::StringValue(ctx.host.clone())) + ); + assert_eq!(attribute("server.port"), Some(&Value::IntValue(443))); + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn unsupported_connect_l7_route_keeps_one_domain_record() { + for level in ["warn", "debug"] { + for protocol in [ + TunnelProtocol::H2cPriorKnowledge, + TunnelProtocol::Unsupported, + ] { + let requirement = + inspection_requirement(true, crate::l7::middleware::UninspectableTrafficGate::Deny); + assert_eq!(requirement, InspectionRequirement::L7Route); + let detail = unsupported_l7_tunnel_protocol_detail(protocol, requirement).unwrap(); + let ctx = unsupported_connect_context(); + let (events, received) = exported(level, || { + emit_unsupported_connect_fixture(&ctx, requirement, detail); + }) + .await; + + assert_eq!(events.len(), 1); + assert_eq!(events[0]["class_uid"], 4001); + assert_eq!(events[0]["status_detail"], detail); + assert_deny_resolves(&events, &received, true); + assert_eq!(received.spans.len(), if level == "debug" { 2 } else { 1 }); + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn unsupported_connect_allowed_and_fail_open_controls_do_not_create_denies() { + use crate::l7::middleware::UninspectableTrafficGate; + + for level in ["warn", "debug"] { + for gate in [ + UninspectableTrafficGate::Unrestricted, + UninspectableTrafficGate::BypassWithFinding, + ] { + for protocol in [ + TunnelProtocol::H2cPriorKnowledge, + TunnelProtocol::Unsupported, + ] { + let requirement = inspection_requirement(false, gate); + assert_eq!(requirement, InspectionRequirement::None); + assert!(unsupported_l7_tunnel_protocol_detail(protocol, requirement).is_none()); + let ctx = unsupported_connect_context(); + let (events, received) = exported(level, || { + drop(egress::connect_span(&EgressIntent::connect( + ctx.host.clone(), + ctx.port, + ))); + egress_emit!(build_connect_allow_ocsf_event( + "127.0.0.1:41000".parse().unwrap(), + &ctx.host, + ctx.port, + "curl", + "42", + "-", + "curl", + &ctx.policy_name, + false, + )); + if gate == UninspectableTrafficGate::BypassWithFinding { + crate::l7::middleware::emit_middleware_uninspectable( + &ctx, + "non-http tcp", + false, + ); + } + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + + assert_eq!( + events.len(), + if gate == UninspectableTrafficGate::BypassWithFinding { + 2 + } else { + 1 + } + ); + assert_eq!(events[0]["class_uid"], 4001); + assert_eq!(events[0]["action_id"], 1); + for event in events { + assert!(event.get("trace").is_none()); + } + assert!( + received + .spans + .iter() + .all(|span| span.name != "supervisor.egress.deny") + ); + } + } + } +} diff --git a/crates/openshell-supervisor-network/src/telemetry.rs b/crates/openshell-supervisor-network/src/telemetry.rs new file mode 100644 index 0000000000..02fb137133 --- /dev/null +++ b/crates/openshell-supervisor-network/src/telemetry.rs @@ -0,0 +1,137 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +//! Keep a deny span active during OCSF emission. + +use openshell_ocsf::{ActionId, OcsfEvent}; + +/// Emit egress events inside an INFO deny span. `denied:` supplies the decision +/// for findings without an action; domain events carry their own action. +/// A saved connect span parents denies after authorization exits. +macro_rules! egress_emit { + ($event:expr) => { + $crate::telemetry::emit($event, None, false) + }; + (deny_parent: $parent:expr, $event:expr) => { + $crate::telemetry::emit($event, Some($parent), false) + }; + (deny_parent: $parent:expr, denied: $denied:expr, $event:expr) => {{ + // Evaluate the decision before moving the event it may inspect. + let denied = $denied; + $crate::telemetry::emit($event, Some($parent), denied) + }}; + (optional_deny_parent: $parent:expr, $event:expr) => { + $crate::telemetry::emit($event, $parent, false) + }; + (denied: $denied:expr, $event:expr) => {{ + // Evaluate the decision before moving the event it may inspect. + let denied = $denied; + $crate::telemetry::emit($event, None, denied) + }}; +} +pub(crate) use egress_emit; + +fn is_denied(event: &OcsfEvent) -> bool { + match event { + OcsfEvent::NetworkActivity(event) => event.action == Some(ActionId::Denied), + OcsfEvent::HttpActivity(event) => event.action == Some(ActionId::Denied), + OcsfEvent::DetectionFinding(event) => event.action == Some(ActionId::Denied), + _ => false, + } +} + +pub fn emit(event: OcsfEvent, parent: Option<&tracing::Span>, denied: bool) { + if !denied && !is_denied(&event) { + openshell_ocsf::ocsf_emit!(event); + return; + } + let span = deny_span(&event, parent); + span.in_scope(|| openshell_ocsf::ocsf_emit!(event)); +} + +/// Emit all records of one synchronous decision under one deny span. Different +/// decisions remain separate, even when they concern the same connection. +pub fn emit_decision( + events: impl IntoIterator, + parent: Option<&tracing::Span>, + denied: bool, +) { + let events: Vec<_> = events.into_iter().collect(); + let primary = events + .iter() + .find(|event| is_denied(event)) + .or_else(|| if denied { events.first() } else { None }); + let span = primary.map(|event| deny_span(event, parent)); + let emit = || { + for event in events { + openshell_ocsf::ocsf_emit!(event); + } + }; + if let Some(span) = span { + span.in_scope(emit); + } else { + emit(); + } +} + +/// Build a decision scope, reusing an active deny scope for its companion +/// records rather than creating another exported span. +pub fn deny_span(event: &OcsfEvent, parent: Option<&tracing::Span>) -> tracing::Span { + let current = tracing::Span::current(); + if current + .metadata() + .is_some_and(|metadata| metadata.name() == "supervisor.egress.deny") + { + return current; + } + let (endpoint, policy) = match event { + OcsfEvent::NetworkActivity(e) => (e.dst_endpoint.as_ref(), e.firewall_rule.as_ref()), + OcsfEvent::HttpActivity(e) => (e.dst_endpoint.as_ref(), e.firewall_rule.as_ref()), + _ => (None, None), + }; + + // Finding evidence supplies decision fields, not a trace parent. + let evidence = |key: &str| match event { + OcsfEvent::DetectionFinding(e) => e.evidences.as_ref().and_then(|items| { + items + .iter() + .find_map(|item| item.data.as_ref()?.get(key)?.as_str()) + }), + _ => None, + }; + let policy = policy + .map(|rule| rule.name.as_str()) + .or_else(|| evidence("policy")); + let address = endpoint + .and_then(|endpoint| endpoint.domain.as_deref().or(endpoint.ip.as_deref())) + .or_else(|| evidence("host")); + let port = endpoint.and_then(|endpoint| endpoint.port); + let reason = event.base().status_detail.as_deref(); + let parent = parent.cloned().unwrap_or_else(tracing::Span::current); + let span = tracing::info_span!( + parent: &parent, + "supervisor.egress.deny", + openshell.policy.decision = "deny", + openshell.policy.name = tracing::field::Empty, + openshell.policy.reason = tracing::field::Empty, + server.address = tracing::field::Empty, + server.port = tracing::field::Empty, + ocsf.class_uid = i64::from(event.class_uid()), + ); + if let Some(policy) = policy { + span.record("openshell.policy.name", policy); + } + if let Some(reason) = reason { + span.record("openshell.policy.reason", reason); + } + if let Some(address) = address { + span.record("server.address", address); + } + if let Some(port) = port { + span.record("server.port", i64::from(port)); + } + span +} + +#[cfg(test)] +pub mod tests; diff --git a/crates/openshell-supervisor-network/src/telemetry/tests.rs b/crates/openshell-supervisor-network/src/telemetry/tests.rs new file mode 100644 index 0000000000..dc22af1c7b --- /dev/null +++ b/crates/openshell-supervisor-network/src/telemetry/tests.rs @@ -0,0 +1,363 @@ +// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +// SPDX-License-Identifier: Apache-2.0 + +use std::sync::{Arc, LazyLock, Mutex}; + +use openshell_otel_test_support::{OtlpTestServer, ReceivedTraces, tracing_test_lock}; +use tracing_subscriber::prelude::*; + +#[derive(Clone)] +struct Writer(Arc>>); +impl std::io::Write for Writer { + fn write(&mut self, bytes: &[u8]) -> std::io::Result { + self.0.lock().unwrap().extend_from_slice(bytes); + Ok(bytes.len()) + } + fn flush(&mut self) -> std::io::Result<()> { + Ok(()) + } +} + +/// Capture the actual OCSF dispatch and receive spans over OTLP/gRPC. +pub async fn exported( + log_level: &str, + emit: impl FnOnce(), +) -> (Vec, ReceivedTraces) { + static REGISTER: LazyLock<()> = LazyLock::new(|| { + assert!(openshell_ocsf::register_trace_correlation_extractor( + openshell_otel::current_ocsf_trace_correlation + )); + }); + let _lock = tracing_test_lock().await; + LazyLock::force(®ISTER); + let collector = OtlpTestServer::start().await; + let (provider, error) = openshell_otel::provider_for(Some(openshell_otel::OtlpExportConfig { + endpoint: collector.endpoint(), + service_name: openshell_otel::ServiceName::Fixed("openshell-supervisor"), + service_version: None, + resource_attributes: vec![], + })); + assert!(error.is_none()); + let provider = provider.unwrap(); + let bytes = Arc::new(Mutex::new(vec![])); + let subscriber = tracing_subscriber::registry() + .with( + openshell_ocsf::OcsfJsonlLayer::new(Writer(bytes.clone())) + .with_filter(tracing_subscriber::filter::LevelFilter::INFO), + ) + .with( + openshell_otel::layer(&provider, "openshell-supervisor") + .with_filter(openshell_otel::supervisor_span_filter(log_level)), + ) + // The shared test registry keeps callsites enabled process-wide. + // Gate this subscriber too, so the default case also checks a disabled + // DEBUG connect handle, as well as absence from the OTLP export. + .with(openshell_otel::supervisor_span_filter(log_level)); + tracing::subscriber::with_default(subscriber, emit); + provider.force_flush().unwrap(); + collector.wait_for_export().await; + provider.shutdown().unwrap(); + let received = collector.shutdown().await; + let events = String::from_utf8(bytes.lock().unwrap().clone()) + .unwrap() + .lines() + .map(|line| serde_json::from_str(line).unwrap()) + .collect(); + (events, received) +} + +pub fn assert_deny_resolves(events: &[serde_json::Value], received: &ReceivedTraces, root: bool) { + use opentelemetry_proto::tonic::common::v1::any_value::Value; + + assert!(!events.is_empty()); + for event in events { + let uid = event["trace"]["uid"] + .as_str() + .expect("emission was inside sampled deny span"); + assert_eq!(uid.len(), 32); + assert!( + event["metadata"]["profiles"] + .as_array() + .unwrap() + .iter() + .any(|p| p == "trace") + ); + let span = received + .spans + .iter() + .find(|span| { + span.name == "supervisor.egress.deny" && hex::encode(&span.trace_id) == uid + }) + .expect("OCSF trace.uid resolves to exported deny span"); + if root { + assert!(span.parent_span_id.is_empty()); + assert_eq!( + received + .spans + .iter() + .filter(|other| other.trace_id == span.trace_id) + .count(), + 1 + ); + } + let attributes = span + .attributes + .iter() + .map(|kv| kv.key.as_str()) + .collect::>(); + for key in ["openshell.policy.decision", "ocsf.class_uid"] { + assert!(attributes.contains(&key), "deny span carries {key}"); + } + let class_uid = span + .attributes + .iter() + .find(|attribute| attribute.key == "ocsf.class_uid") + .and_then(|attribute| attribute.value.as_ref()?.value.as_ref()); + assert!( + matches!(class_uid, Some(Value::IntValue(_))), + "deny span exports ocsf.class_uid as an integer: {class_uid:?}" + ); + } +} + +pub fn assert_deny_attribute(received: &ReceivedTraces, key: &str, expected: &str) { + use opentelemetry_proto::tonic::common::v1::any_value::Value; + let deny = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.deny") + .unwrap(); + let attribute = deny + .attributes + .iter() + .find(|attribute| attribute.key == key) + .unwrap(); + assert_eq!( + attribute.value.as_ref().unwrap().value.as_ref().unwrap(), + &Value::StringValue(expected.to_string()) + ); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn companion_emissions_reuse_an_active_decision_scope() { + let (events, received) = exported("warn", || { + let event = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain( + "blocked.example", + 443, + )) + .build(); + let finding = + openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()).build(); + let scope = super::deny_span(&event, None); + scope.in_scope(|| { + super::emit(event, None, false); + super::emit(finding, None, true); + }); + }) + .await; + assert_eq!(events.len(), 2); + assert_eq!(received.spans.len(), 1); + assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); + assert_deny_resolves(&events, &received, true); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { + for level in ["warn", "debug"] { + let (events, received) = exported(level, || { + let dispatch = tracing::dispatcher::get_default(Clone::clone); + let barrier = std::sync::Barrier::new(2); + std::thread::scope(|threads| { + for host in ["alpha.example", "beta.example"] { + let dispatch = &dispatch; + let barrier = &barrier; + threads.spawn(move || { + tracing::dispatcher::with_default(dispatch, || { + let outside = openshell_ocsf::ctx::ctx().sandbox_id.clone(); + let mut context = (*openshell_ocsf::ctx::ctx()).clone(); + context.sandbox_id = host.to_string(); + context.sandbox_name = format!("sandbox-{host}"); + openshell_ocsf::ctx::bind_thread_ctx(Some(Arc::new(context))); + let connect = tracing::debug_span!("supervisor.egress.connect"); + connect.in_scope(|| { + for attempt in 0..2 { + let decision = format!("{host}:{attempt}"); + let event = openshell_ocsf::NetworkActivityBuilder::new( + openshell_ocsf::ctx::ctx(), + ) + .action(openshell_ocsf::ActionId::Denied) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain(host, 443)) + .status_detail(&decision) + .message(&decision) + .build(); + let finding = openshell_ocsf::DetectionFindingBuilder::new( + openshell_ocsf::ctx::ctx(), + ) + .message(&decision) + .build(); + let scope = super::deny_span(&event, None); + scope.in_scope(|| { + super::emit(event, None, false); + // Both threads keep different deny scopes entered + // while their companion records interleave. + barrier.wait(); + super::emit(finding, None, true); + barrier.wait(); + }); + } + }); + openshell_ocsf::ctx::bind_thread_ctx(None); + assert_eq!(openshell_ocsf::ctx::ctx().sandbox_id, outside); + }); + }); + } + }); + }) + .await; + + assert_eq!(events.len(), 8); + assert_deny_resolves(&events, &received, level == "warn"); + let denies = received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .collect::>(); + assert_eq!(denies.len(), 4); + assert_eq!(received.spans.len(), if level == "debug" { 6 } else { 4 }); + let attribute = |span: &opentelemetry_proto::tonic::trace::v1::Span, key: &str| { + use opentelemetry_proto::tonic::common::v1::any_value::Value; + match span + .attributes + .iter() + .find(|attribute| attribute.key == key) + .and_then(|attribute| attribute.value.as_ref()) + .and_then(|value| value.value.as_ref()) + { + Some(Value::StringValue(value)) => value.clone(), + other => panic!("expected string attribute {key}, got {other:?}"), + } + }; + let mut traces_by_host = Vec::new(); + for host in ["alpha.example", "beta.example"] { + let mut traces = Vec::new(); + for attempt in 0..2 { + let decision = format!("{host}:{attempt}"); + let pair = events + .iter() + .filter(|event| event["message"] == decision) + .collect::>(); + assert_eq!(pair.len(), 2); + for event in &pair { + assert_eq!(event["container"]["uid"], host); + assert_eq!(event["container"]["name"], format!("sandbox-{host}")); + } + assert_eq!(pair[0]["trace"]["uid"], pair[1]["trace"]["uid"]); + let spans = denies + .iter() + .filter(|span| attribute(span, "openshell.policy.reason") == decision) + .collect::>(); + assert_eq!(spans.len(), 1); + let deny = spans[0]; + assert_eq!(attribute(deny, "server.address"), host); + assert_eq!(pair[0]["trace"]["uid"], hex::encode(&deny.trace_id)); + if level == "debug" { + let connect = received + .spans + .iter() + .find(|span| span.span_id == deny.parent_span_id) + .unwrap(); + assert_eq!(connect.name, "supervisor.egress.connect"); + assert_eq!(connect.trace_id, deny.trace_id); + } + traces.push(deny.trace_id.clone()); + } + if level == "debug" { + assert_eq!(traces[0], traces[1]); + } else { + assert_ne!(traces[0], traces[1]); + } + traces_by_host.push(traces); + } + for alpha in &traces_by_host[0] { + for beta in &traces_by_host[1] { + assert_ne!( + alpha, beta, + "independent request contexts must stay separate" + ); + } + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn missing_deny_context_leaves_optional_attributes_unset() { + let (events, received) = exported("warn", || { + let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .message("diagnostic text is not a policy reason") + .build(); + super::emit(finding, None, false); + let network = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .dst_endpoint(openshell_ocsf::Endpoint { + name: None, + domain: None, + ip: None, + port: None, + svc_name: None, + }) + .build(); + super::emit(network, None, false); + }) + .await; + assert_deny_resolves(&events, &received, true); + assert_eq!(events.len(), 2); + assert_eq!(received.spans.len(), 2); + for span in &received.spans { + for key in [ + "openshell.policy.name", + "openshell.policy.reason", + "server.address", + "server.port", + ] { + assert!( + span.attributes.iter().all(|kv| kv.key != key), + "{key} stays unset" + ); + } + } +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn allowed_emissions_do_not_create_info_deny_spans() { + let (events, received) = exported("warn", || { + let allowed = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Allowed) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain( + "allowed.example", + 443, + )) + .build(); + super::emit(allowed, None, false); + crate::l7::middleware::emit_middleware_uninspectable( + &crate::l7::relay::L7EvalContext::default(), + "unknown protocol", + false, + ); + // Flush an unrelated INFO span so the collector wait is bounded by an export. + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert_eq!(events.len(), 2); + for event in events { + assert!(event.get("trace").is_none()); + } + assert!( + !received + .spans + .iter() + .any(|span| span.name == "supervisor.egress.deny") + ); +} diff --git a/crates/openshell-supervisor/src/main.rs b/crates/openshell-supervisor/src/main.rs index feb3aea9c8..4c1bcac7a0 100644 --- a/crates/openshell-supervisor/src/main.rs +++ b/crates/openshell-supervisor/src/main.rs @@ -18,7 +18,6 @@ use openshell_core::sandbox_env::OtlpProtocol; use openshell_isolation_interface::contract::BackendDescriptor; use tracing::{error, info, warn}; use tracing_subscriber::EnvFilter; -use tracing_subscriber::filter::LevelFilter; use tracing_subscriber::{Layer as _, layer::SubscriberExt as _, util::SubscriberInitExt as _}; mod logging; @@ -455,6 +454,10 @@ fn main() -> Result<()> { return openshell_supervisor::check_control_readiness(&args.socket); } + openshell_ocsf::register_trace_correlation_extractor( + openshell_otel::current_ocsf_trace_correlation, + ); + let args = Args::parse(); if args.mode == SupervisorMode::Shared { return shared::run(args); @@ -563,7 +566,7 @@ fn main() -> Result<()> { otlp_layer_provider .as_ref() .map(|provider| openshell_otel::layer(provider, SERVICE_NAME)) - .with_filter(otlp_span_filter(&args.log_level)), + .with_filter(openshell_otel::supervisor_span_filter(&args.log_level)), ) .init(); if !file_available { @@ -845,16 +848,6 @@ fn supervisor_resource_attributes( .collect() } -/// A more verbose log level raises `openshell*` spans; dependency spans stay at -/// INFO so they do not flood the exporter queue. -fn otlp_span_filter(log_level: &str) -> EnvFilter { - let level = log_level - .parse::() - .unwrap_or(LevelFilter::INFO) - .max(LevelFilter::INFO); - EnvFilter::new(format!("info,openshell={level}")) -} - /// Choose the supervisor's exit status for a sandbox run. /// /// The reserved status tells the compute driver that the sandbox rejected the @@ -957,15 +950,6 @@ mod tests { use super::*; - #[test] - fn otlp_span_filter_raises_only_openshell_targets() { - let directives = |log_level: &str| otlp_span_filter(log_level).to_string(); - assert_eq!(directives("warn"), "openshell=info,info"); - assert_eq!(directives("info"), "openshell=info,info"); - assert_eq!(directives("debug"), "openshell=debug,info"); - assert_eq!(directives("info,h2=debug"), "openshell=info,info"); - } - #[test] fn only_workspace_validation_failure_exits_with_reserved_status() { use miette::WrapErr as _; diff --git a/docs/observability/ocsf-json-export.mdx b/docs/observability/ocsf-json-export.mdx index e5cc5e363b..bd8ebddffa 100644 --- a/docs/observability/ocsf-json-export.mdx +++ b/docs/observability/ocsf-json-export.mdx @@ -286,6 +286,64 @@ And a denied connection, produced when `curl https://github.com` runs in a sandb The JSON examples above are formatted for readability. The actual JSONL file contains one JSON object per line with no whitespace formatting. +## Follow a Deny Trace + +Automatic correlation adds `trace.uid` to events emitted inside a valid, +sampled OpenTelemetry span and `trace` to `metadata.profiles`. The UID is a W3C trace ID +with 32 lowercase hexadecimal characters. Search for it in your configured +Jaeger or Tempo backend to inspect the supervisor's handling of the deny. +Without an active sampled context, automatic correlation adds neither the +trace object nor its profile, including when OTLP export is disabled. +A sampled ID does not guarantee +successful export or retention in the trace backend. + +Official OCSF 1.8.0 includes the Trace profile on +[HTTP Activity](https://github.com/ocsf/ocsf-schema/blob/v1.8.0/events/network/http_activity.json) +and [API Activity](https://github.com/ocsf/ocsf-schema/blob/v1.8.0/events/application/api_activity.json). +OpenShell extends its applicability to Network Activity, Detection Finding, +Authentication, Base Event, SSH Activity, Process Activity, Application Lifecycle, +and Device Config State Change. This optional profile on those eight classes is +an OpenShell extension beyond the official 1.8.0 class definitions. Consumers +that enforce official profile applicability may reject these correlated records +unless configured to accept the extension. + +Supervisor deny correlation requires a dedicated supervisor configured for OTLP +trace export. Shared supervisor hosts currently do not initialize OTLP exporters, +so their sandbox audit records have no automatic trace correlation. + +```json +{ + "metadata": { "profiles": ["security_control", "trace"] }, + "trace": { "uid": "0af7651916cd43dd8448eb211c80319c" } +} +``` + +With OTLP export enabled, a network or HTTP deny creates an INFO +`supervisor.egress.deny` span around the audit records for that decision. +A domain event and its companion findings share one trace ID and one deny span. At the default supervisor +log level, the DEBUG connect span is disabled, so the trace contains only the +root deny span. It records the policy, reason and destination when available. +At debug level, a deny can share the connect trace and its authorization, +resolve and dial spans if those steps ran and the connect span remains +available. Allowed connections stay at DEBUG. Workload `traceparent` headers +do not supply supervisor correlation. + +Gateway audit records can inherit the caller's incoming `traceparent`, including +records emitted before authentication succeeds. Their trace IDs are correlation +hints, not evidence of the caller's identity or trust. An unsampled incoming +context can omit correlation. + +A deny span represents an enforced supervisor refusal, including fail-closed +middleware capacity refusals. When response middleware stops delivery, or the +proxy refuses to deliver a malformed upstream response head, it creates a deny +span. Ordinary upstream resets, downstream write failures, and response-body +framing errors do not create deny spans. Any delivery-failure findings describe +transport failure rather than an enforced refusal. +Allowed fail-open and audit-only traffic do not +create deny spans. Each refused decision can create an exported span, so repeated +refusals can increase telemetry volume; export and retention remain bounded by +your telemetry pipeline. + ## OCSF Event Classes in JSON The `class_uid` field identifies the event type: From 533224cbcc79f64b65c3c11e022e4702638d5886 Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 09:07:48 -0800 Subject: [PATCH 02/12] refactor(ocsf): validate trace correlation IDs TraceCorrelation accepted any string in a field documented as a W3C trace ID, and every builder exposed a .trace() override that only tests called. Build the correlation from the 16-byte trace ID, reject malformed or all-zero IDs on deserialization, and drop the builder setters so the registered extractor is the only source of trace.uid. Signed-off-by: Kris Hicks --- .../src/builders/api_activity.rs | 13 - .../src/builders/authentication.rs | 12 - crates/openshell-ocsf/src/builders/base.rs | 13 - crates/openshell-ocsf/src/builders/config.rs | 13 - crates/openshell-ocsf/src/builders/finding.rs | 13 - crates/openshell-ocsf/src/builders/http.rs | 15 -- .../openshell-ocsf/src/builders/lifecycle.rs | 13 - crates/openshell-ocsf/src/builders/network.rs | 15 -- crates/openshell-ocsf/src/builders/process.rs | 14 -- crates/openshell-ocsf/src/builders/ssh.rs | 14 -- .../openshell-ocsf/src/events/base_event.rs | 2 +- crates/openshell-ocsf/src/trace.rs | 230 +++++++----------- crates/openshell-otel/src/correlation.rs | 9 +- crates/openshell-otel/src/ocsf.rs | 13 +- .../openshell-otel/tests/ocsf_correlation.rs | 46 +--- 15 files changed, 106 insertions(+), 329 deletions(-) diff --git a/crates/openshell-ocsf/src/builders/api_activity.rs b/crates/openshell-ocsf/src/builders/api_activity.rs index d238364110..480ca575dd 100644 --- a/crates/openshell-ocsf/src/builders/api_activity.rs +++ b/crates/openshell-ocsf/src/builders/api_activity.rs @@ -29,7 +29,6 @@ fn sanitize_model_name(name: &str) -> String { /// Builder for API Activity [6003] events. pub struct ApiActivityBuilder<'a> { ctx: ContextRef<'a>, - trace: Option, severity: SeverityId, status: Option, message: Option, @@ -49,18 +48,10 @@ pub struct ApiActivityBuilder<'a> { } impl<'a> ApiActivityBuilder<'a> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - #[must_use] pub fn new(ctx: impl Into>, operation: impl Into) -> Self { Self { ctx: ctx.into(), - trace: None, severity: SeverityId::Informational, status: None, message: None, @@ -210,10 +201,6 @@ impl<'a> ApiActivityBuilder<'a> { self.ctx .apply_common_fields(&mut base, self.status, self.message); - if let Some(trace) = self.trace { - base.set_trace(trace); - } - OcsfEvent::ApiActivity(ApiActivityEvent { base, api: Api { diff --git a/crates/openshell-ocsf/src/builders/authentication.rs b/crates/openshell-ocsf/src/builders/authentication.rs index 7b412a49ed..e901d5134c 100644 --- a/crates/openshell-ocsf/src/builders/authentication.rs +++ b/crates/openshell-ocsf/src/builders/authentication.rs @@ -12,7 +12,6 @@ use crate::objects::{Endpoint, HttpRequest, Service, User}; /// Builder for Authentication [3002] Logon events. pub struct AuthenticationBuilder<'a> { ctx: ContextRef<'a>, - trace: Option, user: User, service: Service, auth_protocol: Option, @@ -29,18 +28,10 @@ pub struct AuthenticationBuilder<'a> { } impl<'a> AuthenticationBuilder<'a> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - #[must_use] pub fn new(ctx: impl Into>, user: User, service: Service) -> Self { Self { ctx: ctx.into(), - trace: None, user, service, auth_protocol: None, @@ -122,9 +113,6 @@ impl<'a> AuthenticationBuilder<'a> { if let Some(device) = base.device.as_mut() { device.container = None; } - if let Some(trace) = self.trace { - base.set_trace(trace); - } OcsfEvent::Authentication(AuthenticationEvent { base, diff --git a/crates/openshell-ocsf/src/builders/base.rs b/crates/openshell-ocsf/src/builders/base.rs index 5243caac7a..c08f1aa0aa 100644 --- a/crates/openshell-ocsf/src/builders/base.rs +++ b/crates/openshell-ocsf/src/builders/base.rs @@ -11,7 +11,6 @@ use crate::events::{BaseEvent, OcsfEvent}; /// Builder for Base Event [0] — events without a specific OCSF class. pub struct BaseEventBuilder<'a> { ctx: ContextRef<'a>, - trace: Option, severity: SeverityId, status: Option, message: Option, @@ -20,18 +19,10 @@ pub struct BaseEventBuilder<'a> { } impl<'a> BaseEventBuilder<'a> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - #[must_use] pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), - trace: None, severity: SeverityId::Informational, status: None, message: None, @@ -72,10 +63,6 @@ impl<'a> BaseEventBuilder<'a> { self.ctx .apply_common_fields(&mut base, self.status, self.message); - if let Some(trace) = self.trace { - base.set_trace(trace); - } - OcsfEvent::Base(BaseEvent { base }) } } diff --git a/crates/openshell-ocsf/src/builders/config.rs b/crates/openshell-ocsf/src/builders/config.rs index 25e229d04e..906470408d 100644 --- a/crates/openshell-ocsf/src/builders/config.rs +++ b/crates/openshell-ocsf/src/builders/config.rs @@ -11,7 +11,6 @@ use crate::events::{DeviceConfigStateChangeEvent, OcsfEvent}; /// Builder for Device Config State Change [5019] events. pub struct ConfigStateChangeBuilder<'a> { ctx: ContextRef<'a>, - trace: Option, severity: SeverityId, status: Option, state_id: Option, @@ -23,18 +22,10 @@ pub struct ConfigStateChangeBuilder<'a> { } impl<'a> ConfigStateChangeBuilder<'a> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - #[must_use] pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), - trace: None, severity: SeverityId::Informational, status: None, state_id: None, @@ -91,10 +82,6 @@ impl<'a> ConfigStateChangeBuilder<'a> { self.ctx .apply_common_fields(&mut base, self.status, self.message); - if let Some(trace) = self.trace { - base.set_trace(trace); - } - OcsfEvent::DeviceConfigStateChange(DeviceConfigStateChangeEvent { base, state: self.state_id, diff --git a/crates/openshell-ocsf/src/builders/finding.rs b/crates/openshell-ocsf/src/builders/finding.rs index b4152549c0..fe66c4c796 100644 --- a/crates/openshell-ocsf/src/builders/finding.rs +++ b/crates/openshell-ocsf/src/builders/finding.rs @@ -12,7 +12,6 @@ use crate::objects::{Attack, Evidence, FindingInfo, Remediation}; /// Builder for Detection Finding [2004] events. pub struct DetectionFindingBuilder<'a> { ctx: ContextRef<'a>, - trace: Option, activity: ActivityId, severity: SeverityId, action: Option, @@ -31,18 +30,10 @@ pub struct DetectionFindingBuilder<'a> { } impl<'a> DetectionFindingBuilder<'a> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - #[must_use] pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), - trace: None, activity: ActivityId::Open, severity: SeverityId::Medium, action: None, @@ -158,10 +149,6 @@ impl<'a> DetectionFindingBuilder<'a> { } self.ctx.apply_common_fields(&mut base, None, self.message); - if let Some(trace) = self.trace { - base.set_trace(trace); - } - OcsfEvent::DetectionFinding(DetectionFindingEvent { base, finding_info: self diff --git a/crates/openshell-ocsf/src/builders/http.rs b/crates/openshell-ocsf/src/builders/http.rs index 2738785c20..e2f85bdab2 100644 --- a/crates/openshell-ocsf/src/builders/http.rs +++ b/crates/openshell-ocsf/src/builders/http.rs @@ -12,7 +12,6 @@ use crate::objects::{Actor, Endpoint, FirewallRule, HttpRequest, HttpResponse}; /// Builder for HTTP Activity [4002] events. pub struct HttpActivityBuilder<'a, Context = MissingHttpContext> { ctx: ContextRef<'a>, - trace: Option, activity: ActivityId, action: Option, disposition: Option, @@ -51,7 +50,6 @@ impl<'a> HttpActivityBuilder<'a, MissingHttpContext> { pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), - trace: None, activity: ActivityId::Unknown, action: None, disposition: None, @@ -96,17 +94,9 @@ impl HttpActivityBuilder<'_, HasHttpContext> { } impl<'a, Context> HttpActivityBuilder<'a, Context> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - fn with_http_request(self, req: HttpRequest) -> HttpActivityBuilder<'a, HasHttpContext> { HttpActivityBuilder { ctx: self.ctx, - trace: self.trace, activity: self.activity, action: self.action, disposition: self.disposition, @@ -128,7 +118,6 @@ impl<'a, Context> HttpActivityBuilder<'a, Context> { fn with_http_response(self, resp: HttpResponse) -> HttpActivityBuilder<'a, HasHttpContext> { HttpActivityBuilder { ctx: self.ctx, - trace: self.trace, activity: self.activity, action: self.action, disposition: self.disposition, @@ -212,10 +201,6 @@ impl HttpActivityBuilder<'_, HasHttpContext> { self.ctx .apply_common_fields(&mut base, self.status, self.message); - if let Some(trace) = self.trace { - base.set_trace(trace); - } - OcsfEvent::HttpActivity(HttpActivityEvent { base, http_request: self.http_request, diff --git a/crates/openshell-ocsf/src/builders/lifecycle.rs b/crates/openshell-ocsf/src/builders/lifecycle.rs index f0a2357179..b425b3e79b 100644 --- a/crates/openshell-ocsf/src/builders/lifecycle.rs +++ b/crates/openshell-ocsf/src/builders/lifecycle.rs @@ -12,7 +12,6 @@ use crate::objects::Product; /// Builder for Application Lifecycle [6002] events. pub struct AppLifecycleBuilder<'a> { ctx: ContextRef<'a>, - trace: Option, activity: ActivityId, severity: SeverityId, status: Option, @@ -20,18 +19,10 @@ pub struct AppLifecycleBuilder<'a> { } impl<'a> AppLifecycleBuilder<'a> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - #[must_use] pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), - trace: None, activity: ActivityId::Unknown, severity: SeverityId::Informational, status: None, @@ -55,10 +46,6 @@ impl<'a> AppLifecycleBuilder<'a> { self.ctx .apply_common_fields(&mut base, self.status, self.message); - if let Some(trace) = self.trace { - base.set_trace(trace); - } - OcsfEvent::ApplicationLifecycle(ApplicationLifecycleEvent { base, app: Product::openshell_sandbox(&self.ctx.product_version), diff --git a/crates/openshell-ocsf/src/builders/network.rs b/crates/openshell-ocsf/src/builders/network.rs index 81b0293475..950cc7e1c8 100644 --- a/crates/openshell-ocsf/src/builders/network.rs +++ b/crates/openshell-ocsf/src/builders/network.rs @@ -12,7 +12,6 @@ use crate::objects::{Actor, ConnectionInfo, Endpoint, FirewallRule}; /// Builder for Network Activity [4001] events. pub struct NetworkActivityBuilder<'a, EndpointState = MissingNetworkEndpoint> { ctx: ContextRef<'a>, - trace: Option, activity: ActivityId, activity_name: Option, action: Option, @@ -53,7 +52,6 @@ impl<'a> NetworkActivityBuilder<'a, MissingNetworkEndpoint> { pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), - trace: None, activity: ActivityId::Unknown, activity_name: None, action: None, @@ -107,20 +105,12 @@ impl NetworkActivityBuilder<'_, HasNetworkEndpoint> { } impl<'a, EndpointState> NetworkActivityBuilder<'a, EndpointState> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - fn with_src_endpoint( self, endpoint: Endpoint, ) -> NetworkActivityBuilder<'a, HasNetworkEndpoint> { NetworkActivityBuilder { ctx: self.ctx, - trace: self.trace, activity: self.activity, activity_name: self.activity_name, action: self.action, @@ -147,7 +137,6 @@ impl<'a, EndpointState> NetworkActivityBuilder<'a, EndpointState> { ) -> NetworkActivityBuilder<'a, HasNetworkEndpoint> { NetworkActivityBuilder { ctx: self.ctx, - trace: self.trace, activity: self.activity, activity_name: self.activity_name, action: self.action, @@ -254,10 +243,6 @@ impl NetworkActivityBuilder<'_, HasNetworkEndpoint> { self.ctx .apply_common_fields(&mut base, self.status, self.message); - if let Some(trace) = self.trace { - base.set_trace(trace); - } - OcsfEvent::NetworkActivity(NetworkActivityEvent { base, src_endpoint: self.src_endpoint, diff --git a/crates/openshell-ocsf/src/builders/process.rs b/crates/openshell-ocsf/src/builders/process.rs index 087d4f401a..ae6a6dfe14 100644 --- a/crates/openshell-ocsf/src/builders/process.rs +++ b/crates/openshell-ocsf/src/builders/process.rs @@ -12,7 +12,6 @@ use crate::objects::{Actor, Process}; /// Builder for Process Activity [1007] events. pub struct ProcessActivityBuilder<'a, ActorState = MissingActor> { ctx: ContextRef<'a>, - trace: Option, activity: ActivityId, severity: SeverityId, status: Option, @@ -46,7 +45,6 @@ impl<'a> ProcessActivityBuilder<'a, MissingActor> { pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), - trace: None, activity: ActivityId::Unknown, severity: SeverityId::Informational, status: None, @@ -66,7 +64,6 @@ impl<'a> ProcessActivityBuilder<'a, MissingActor> { pub fn actor_process(self, process: Process) -> ProcessActivityBuilder<'a, HasActor> { ProcessActivityBuilder { ctx: self.ctx, - trace: self.trace, activity: self.activity, severity: self.severity, status: self.status, @@ -83,13 +80,6 @@ impl<'a> ProcessActivityBuilder<'a, MissingActor> { } impl ProcessActivityBuilder<'_, ActorState> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - /// Set the action taken. /// Set the disposition of the action. /// Set the event severity. @@ -134,10 +124,6 @@ impl ProcessActivityBuilder<'_, HasActor> { self.ctx .apply_common_fields(&mut base, self.status, self.message); - if let Some(trace) = self.trace { - base.set_trace(trace); - } - OcsfEvent::ProcessActivity(ProcessActivityEvent { base, process: self.process.unwrap_or_else(|| Process::new("unknown", 0)), diff --git a/crates/openshell-ocsf/src/builders/ssh.rs b/crates/openshell-ocsf/src/builders/ssh.rs index 3153948398..21fdfa0153 100644 --- a/crates/openshell-ocsf/src/builders/ssh.rs +++ b/crates/openshell-ocsf/src/builders/ssh.rs @@ -12,7 +12,6 @@ use crate::objects::{Actor, Endpoint}; /// Builder for SSH Activity [4007] events. pub struct SshActivityBuilder<'a, EndpointState = MissingSshEndpoint> { ctx: ContextRef<'a>, - trace: Option, activity: ActivityId, action: Option, disposition: Option, @@ -49,7 +48,6 @@ impl<'a> SshActivityBuilder<'a, MissingSshEndpoint> { pub fn new(ctx: impl Into>) -> Self { Self { ctx: ctx.into(), - trace: None, activity: ActivityId::Unknown, action: None, disposition: None, @@ -68,13 +66,6 @@ impl<'a> SshActivityBuilder<'a, MissingSshEndpoint> { } impl<'a, EndpointState> SshActivityBuilder<'a, EndpointState> { - /// Set trace correlation explicitly instead of using the active span. - #[must_use] - pub fn trace(mut self, trace: crate::TraceCorrelation) -> Self { - self.trace = Some(trace); - self - } - /// Set the source endpoint from an address. #[must_use] pub fn src_endpoint_addr( @@ -96,7 +87,6 @@ impl<'a, EndpointState> SshActivityBuilder<'a, EndpointState> { fn with_endpoint(self) -> SshActivityBuilder<'a, HasSshEndpoint> { SshActivityBuilder { ctx: self.ctx, - trace: self.trace, activity: self.activity, action: self.action, disposition: self.disposition, @@ -157,10 +147,6 @@ impl SshActivityBuilder<'_, HasSshEndpoint> { self.ctx .apply_common_fields(&mut base, self.status, self.message); - if let Some(trace) = self.trace { - base.set_trace(trace); - } - OcsfEvent::SshActivity(SshActivityEvent { base, src_endpoint: self.src_endpoint, diff --git a/crates/openshell-ocsf/src/events/base_event.rs b/crates/openshell-ocsf/src/events/base_event.rs index a0a6f1b9d5..e441b11ecb 100644 --- a/crates/openshell-ocsf/src/events/base_event.rs +++ b/crates/openshell-ocsf/src/events/base_event.rs @@ -195,7 +195,7 @@ impl BaseEventData { self.ai_model = Some(ai_model); } - /// Set explicit trace correlation and add the Trace profile once. + /// Set trace correlation and add the Trace profile once. pub fn set_trace(&mut self, trace: crate::TraceCorrelation) { self.trace = Some(trace); if !self diff --git a/crates/openshell-ocsf/src/trace.rs b/crates/openshell-ocsf/src/trace.rs index 94c82763c3..c8de1c685f 100644 --- a/crates/openshell-ocsf/src/trace.rs +++ b/crates/openshell-ocsf/src/trace.rs @@ -7,16 +7,51 @@ use std::sync::OnceLock; use serde::{Deserialize, Serialize}; -/// Trace ID supplied by an OCSF producer. +/// W3C trace ID of the span active when an OCSF event was emitted. /// -/// The registered extractor returns valid, sampled context from the active -/// span. Gateway context may inherit a caller's traceparent, including before -/// authentication: this value is a correlation hint, not an identity assertion. -/// Explicit callers are responsible for validating their trace IDs. +/// This is a correlation hint, not an identity assertion: gateway context may +/// inherit a caller's traceparent, including before authentication. #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)] +#[serde(try_from = "TraceFields")] pub struct TraceCorrelation { - /// W3C trace ID: 32 lowercase hexadecimal characters. - pub uid: String, + uid: String, +} + +#[derive(Deserialize)] +struct TraceFields { + uid: String, +} + +impl TryFrom for TraceCorrelation { + type Error = &'static str; + + fn try_from(fields: TraceFields) -> Result { + let uid = fields.uid; + let hex = uid.len() == 32 && uid.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')); + if !hex || uid.bytes().all(|b| b == b'0') { + return Err("trace.uid must be a non-zero W3C trace ID in lowercase hex"); + } + Ok(Self { uid }) + } +} + +impl TraceCorrelation { + /// Returns `None` for the invalid all-zero trace ID. + #[must_use] + pub fn from_trace_id(trace_id: [u8; 16]) -> Option { + if trace_id == [0; 16] { + return None; + } + Some(Self { + uid: format!("{:032x}", u128::from_be_bytes(trace_id)), + }) + } + + /// The trace ID as 32 lowercase hexadecimal characters. + #[must_use] + pub fn uid(&self) -> &str { + &self.uid + } } static EXTRACTOR: OnceLock Option> = OnceLock::new(); @@ -24,7 +59,7 @@ static EXTRACTOR: OnceLock Option> = OnceLock::new(); /// Register the process-wide trace extractor at startup. /// /// Returns `false` if an extractor is already registered. Without an extractor, -/// events receive only explicitly supplied correlation. +/// events carry no trace correlation. pub fn register_trace_correlation_extractor(extractor: fn() -> Option) -> bool { EXTRACTOR.set(extractor).is_ok() } @@ -42,159 +77,64 @@ mod tests { use crate::*; use openshell_ocsf_validate::validate_event; + const TRACE_ID: [u8; 16] = [ + 0x0a, 0xf7, 0x65, 0x19, 0x16, 0xcd, 0x43, 0xdd, 0x84, 0x48, 0xeb, 0x21, 0x1c, 0x80, 0x31, + 0x9c, + ]; + + fn trace() -> TraceCorrelation { + TraceCorrelation::from_trace_id(TRACE_ID).unwrap() + } + #[test] - fn all_builders_preserve_explicit_trace_through_typestate_and_roundtrip() { - let ctx = builders::test_sandbox_context(); - let trace = TraceCorrelation { - uid: "0af7651916cd43dd8448eb211c80319c".to_string(), - }; - for context in [ - ContextRef::from(&ctx), - ContextRef::from(std::sync::Arc::new(ctx.clone())), - ] { - let events = [ - NetworkActivityBuilder::new(context.clone()) - .trace(trace.clone()) - .dst_endpoint(Endpoint::from_domain("example.com", 443)) - .build(), - HttpActivityBuilder::new(context.clone()) - .trace(trace.clone()) - .http_request(HttpRequest::new( - "GET", - Url::new("https", "example.com", "/", 443), - )) - .build(), - BaseEventBuilder::new(context.clone()) - .trace(trace.clone()) - .build(), - AppLifecycleBuilder::new(context.clone()) - .trace(trace.clone()) - .build(), - ConfigStateChangeBuilder::new(context.clone()) - .trace(trace.clone()) - .build(), - DetectionFindingBuilder::new(context.clone()) - .trace(trace.clone()) - .build(), - ProcessActivityBuilder::new(context.clone()) - .trace(trace.clone()) - .actor_process(Process::new("openshell-sandbox", 1)) - .process(Process::new("workload", 2)) - .build(), - SshActivityBuilder::new(context.clone()) - .trace(trace.clone()) - .dst_endpoint(Endpoint::from_ip("192.0.2.1".parse().unwrap(), 22)) - .build(), - AuthenticationBuilder::new( - context.clone(), - User::unidentified(), - Service::new("openshell-gateway"), - ) - .trace(trace.clone()) - .build(), - ApiActivityBuilder::new(context, "GET /") - .trace(trace.clone()) - .build(), - ]; - for event in events { - let value = event.to_json().unwrap(); - assert_eq!(value["device"]["hostname"], ctx.hostname); - if value["class_uid"] == 3002 { - // Authentication's schema does not allow the container profile. - assert!(value.get("container").is_none()); - } else { - assert_eq!(value["container"]["uid"], ctx.sandbox_id); - assert_eq!(value["container"]["name"], ctx.sandbox_name); - } - validate_event(&value).unwrap_or_else(|e| panic!("{e}")); - assert_eq!(value["trace"]["uid"], trace.uid); - assert_eq!(value["trace"].as_object().unwrap().len(), 1); - let decoded: OcsfEvent = serde_json::from_value(value.clone()).unwrap(); - assert_eq!(decoded.to_json().unwrap(), value); - assert_eq!( - value["metadata"]["profiles"] - .as_array() - .unwrap() - .iter() - .filter(|p| *p == "trace") - .count(), - 1 - ); - let mut plain = value; - plain.as_object_mut().unwrap().remove("trace"); - plain["metadata"]["profiles"] - .as_array_mut() - .unwrap() - .retain(|name| name != "trace"); - validate_event(&plain).unwrap_or_else(|e| panic!("{e}")); - } - } + fn trace_id_renders_as_lowercase_w3c_hex() { + assert_eq!(trace().uid(), "0af7651916cd43dd8448eb211c80319c"); + assert!(TraceCorrelation::from_trace_id([0; 16]).is_none()); } #[test] - fn production_event_shapes_validate_with_and_without_trace() { - let trace = TraceCorrelation { - uid: "0af7651916cd43dd8448eb211c80319c".to_string(), - }; - for ctx in [ - builders::test_sandbox_context(), - builders::test_gateway_context(), + fn deserialization_rejects_malformed_trace_ids() { + let valid = serde_json::json!({"uid": "0af7651916cd43dd8448eb211c80319c"}); + assert_eq!( + serde_json::from_value::(valid).unwrap(), + trace() + ); + for uid in [ + "", + "0AF7651916CD43DD8448EB211C80319C", + "0af7651916cd43dd8448eb211c80319", + "0af7651916cd43dd8448eb211c80319cz", + "00000000000000000000000000000000", ] { - for (class, mut event) in builders::sample_events(&ctx) { - let plain = event.to_json().unwrap(); - validate_event(&plain).unwrap_or_else(|e| panic!("{class} without trace: {e}")); - event.base_mut().set_trace(trace.clone()); - let correlated = event.to_json().unwrap(); - validate_event(&correlated).unwrap_or_else(|e| panic!("{class} with trace: {e}")); - } + assert!( + serde_json::from_value::(serde_json::json!({ "uid": uid })) + .is_err(), + "{uid:?} accepted" + ); } } #[test] - fn required_typestate_transitions_allow_replacing_explicit_trace() { + fn production_event_shapes_validate_with_and_without_trace() { let ctx = builders::test_sandbox_context(); - let initial = TraceCorrelation { - uid: "0af7651916cd43dd8448eb211c80319c".to_string(), - }; - let replacement = TraceCorrelation { - uid: "4bf92f3577b34da6a3ce929d0e0e4736".to_string(), - }; - let events = [ - ProcessActivityBuilder::new(&ctx) - .trace(initial.clone()) - .actor_process(Process::new("openshell-sandbox", 1)) - .trace(replacement.clone()) - .build(), - SshActivityBuilder::new(&ctx) - .trace(initial.clone()) - .src_endpoint_addr("192.0.2.1".parse().unwrap(), 22) - .trace(replacement.clone()) - .dst_endpoint(Endpoint::from_domain("sandbox.local", 22)) - .build(), - SshActivityBuilder::new(&ctx) - .trace(initial) - .dst_endpoint(Endpoint::from_domain("sandbox.local", 22)) - .trace(replacement.clone()) - .src_endpoint_addr("192.0.2.1".parse().unwrap(), 22) - .build(), - ]; - for event in events { - let value = event.to_json().unwrap(); - assert_eq!(value["trace"]["uid"], replacement.uid); - validate_event(&value).unwrap_or_else(|e| panic!("{e}")); + for (class, mut event) in builders::sample_events(&ctx) { + let plain = event.to_json().unwrap(); + validate_event(&plain).unwrap_or_else(|e| panic!("{class} without trace: {e}")); + event.base_mut().set_trace(trace()); + let correlated = event.to_json().unwrap(); + validate_event(&correlated).unwrap_or_else(|e| panic!("{class} with trace: {e}")); + assert_eq!(correlated["trace"]["uid"], trace().uid()); + let decoded: OcsfEvent = serde_json::from_value(correlated.clone()).unwrap(); + assert_eq!(decoded.to_json().unwrap(), correlated); } } #[test] fn exported_schema_checks_trace_shape_and_declared_profile() { let ctx = builders::test_sandbox_context(); - let mut value = BaseEventBuilder::new(&ctx) - .trace(TraceCorrelation { - uid: "0af7651916cd43dd8448eb211c80319c".to_string(), - }) - .build() - .to_json() - .unwrap(); + let mut event = BaseEventBuilder::new(&ctx).build(); + event.base_mut().set_trace(trace()); + let mut value = event.to_json().unwrap(); validate_event(&value).unwrap_or_else(|e| panic!("{e}")); value["trace"]["uid"] = serde_json::json!(42); assert!(matches!( diff --git a/crates/openshell-otel/src/correlation.rs b/crates/openshell-otel/src/correlation.rs index 7c01c067c8..cb62a134fd 100644 --- a/crates/openshell-otel/src/correlation.rs +++ b/crates/openshell-otel/src/correlation.rs @@ -18,9 +18,8 @@ pub fn current_ocsf_trace_correlation() -> Option, ) -> (serde_json::Value, Vec) { - capture_route(sampler, active, explicit, false) + capture_route(sampler, active, false) } fn capture_route( sampler: Sampler, active: bool, - explicit: Option, routed: bool, ) -> (serde_json::Value, Vec) { - capture_context(sampler, active, explicit, routed, None) + capture_context(sampler, active, routed, None) } fn capture_context( sampler: Sampler, active: bool, - explicit: Option, routed: bool, remote_parent: Option, ) -> (serde_json::Value, Vec) { @@ -76,10 +73,7 @@ fn capture_context( ); return; } - let mut builder = BaseEventBuilder::new(ctx); - if let Some(trace) = explicit { - builder = builder.trace(trace); - } + let builder = BaseEventBuilder::new(ctx); if routed { openshell_ocsf::emit_ocsf_event_routed("test-sandbox", builder.build()); } else { @@ -125,7 +119,6 @@ fn authentication_failure_correlation_can_inherit_sampled_or_unsampled_caller_co let (event, spans) = capture_context( Sampler::ParentBased(Box::new(Sampler::AlwaysOn)), true, - None, false, Some(parent), ); @@ -155,7 +148,7 @@ fn assert_no_trace(value: &serde_json::Value) { #[test] fn sampled_active_span_correlates_to_exported_w3c_trace() { - let (value, spans) = capture(Sampler::AlwaysOn, true, None); + let (value, spans) = capture(Sampler::AlwaysOn, true); let uid = value["trace"]["uid"].as_str().unwrap(); assert_eq!(uid.len(), 32); assert!( @@ -177,14 +170,14 @@ fn sampled_active_span_correlates_to_exported_w3c_trace() { #[test] fn no_active_context_omits_trace_and_profile() { - let (value, spans) = capture(Sampler::AlwaysOn, false, None); + let (value, spans) = capture(Sampler::AlwaysOn, false); assert_no_trace(&value); assert!(spans.is_empty()); } #[test] fn routed_emission_also_enriches_from_sampled_context() { - let (value, spans) = capture_route(Sampler::AlwaysOn, true, None, true); + let (value, spans) = capture_route(Sampler::AlwaysOn, true, true); assert_eq!( value["trace"]["uid"], spans[0].span_context.trace_id().to_string() @@ -200,34 +193,11 @@ fn routed_emission_also_enriches_from_sampled_context() { #[test] fn unsampled_active_context_omits_trace_and_profile() { - let (value, spans) = capture(Sampler::AlwaysOff, true, None); + let (value, spans) = capture(Sampler::AlwaysOff, true); assert_no_trace(&value); assert!(spans.is_empty()); } -#[test] -fn explicit_trace_overrides_automatic_enrichment() { - let explicit = "0af7651916cd43dd8448eb211c80319c"; - let (value, spans) = capture( - Sampler::AlwaysOn, - true, - Some(TraceCorrelation { - uid: explicit.to_string(), - }), - ); - assert_eq!(value["trace"]["uid"], explicit); - assert_ne!(explicit, spans[0].span_context.trace_id().to_string()); - assert_eq!( - value["metadata"]["profiles"] - .as_array() - .unwrap() - .iter() - .filter(|p| *p == "trace") - .count(), - 1 - ); -} - #[test] fn active_tracing_span_without_otel_context_is_invalid() { LazyLock::force(&SETUP); From 8f5a8ca0fcc3759005a0642814e30b2f5d6a4dab Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 09:12:41 -0800 Subject: [PATCH 03/12] fix(ocsf): limit trace correlation to HTTP and API Activity OCSF 1.8.0 declares the Trace profile only for HTTP Activity and API Activity, but trace.uid was added to every class, validated against schemas composed by grafting http_activity onto eight other classes. Strict consumers reject such records outright. Gate enrichment on the event class, drop the composed schemas and their tooling, and vendor only the native HTTP/API +trace exports. The supervisor now opens a deny span only for decisions with an HTTP Activity record, so every exported deny span has a record pointing at it; the wiring that served Network Activity and finding-only denials is removed. Signed-off-by: Kris Hicks --- crates/openshell-ocsf-validate/README.md | 31 - .../schemas/test_trace_schema.py | 187 - .../schemas/trace_schema.py | 201 - .../openshell-ocsf-validate/schemas/update.sh | 28 +- ...container+host+security_control+trace.json | 10566 +++++++-------- ...ity@ai_operation+container+host+trace.json | 10330 +++++++-------- ...operation+host+security_control+trace.json | 10592 +++++++-------- .../api_activity@ai_operation+host+trace.json | 10264 +++++++-------- ...container+host+security_control+trace.json | 10414 +++++++-------- .../api_activity@container+host+trace.json | 10336 +++++++-------- ..._activity@host+security_control+trace.json | 10460 +++++++-------- .../v1.8.0/api_activity@host+trace.json | 10332 +++++++-------- ...cation_lifecycle@container+host+trace.json | 6945 ---------- ...ntication@host+security_control+trace.json | 7807 ------------ .../base_event@container+host+trace.json | 6932 ---------- ...container+host+security_control+trace.json | 9438 -------------- ...n_finding@host+security_control+trace.json | 9406 -------------- ...container+host+security_control+trace.json | 7170 ----------- ...+network_proxy+security_control+trace.json | 10622 ++++++++-------- ...+network_proxy+security_control+trace.json | 8259 ------------ ...container+host+security_control+trace.json | 7745 ----------- ...container+host+security_control+trace.json | 8279 ------------ .../openshell-ocsf/src/events/base_event.rs | 18 +- crates/openshell-ocsf/src/trace.rs | 53 +- .../openshell-otel/tests/ocsf_correlation.rs | 63 +- .../src/l7/middleware.rs | 185 +- .../src/l7/relay.rs | 5 +- .../src/l7/rest.rs | 6 +- .../src/l7/rest/http_response.rs | 40 +- .../src/l7/websocket.rs | 29 +- .../openshell-supervisor-network/src/proxy.rs | 140 +- .../src/proxy/tests/compatibility.rs | 1 - .../src/proxy/trace_tests.rs | 498 +- .../src/telemetry.rs | 58 +- .../src/telemetry/tests.rs | 116 +- docs/observability/ocsf-json-export.mdx | 53 +- 36 files changed, 47337 insertions(+), 120272 deletions(-) delete mode 100644 crates/openshell-ocsf-validate/schemas/test_trace_schema.py delete mode 100644 crates/openshell-ocsf-validate/schemas/trace_schema.py delete mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/application_lifecycle@container+host+trace.json delete mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/authentication@host+security_control+trace.json delete mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/base_event@container+host+trace.json delete mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@container+host+security_control+trace.json delete mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@host+security_control+trace.json delete mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/device_config_state_change@container+host+security_control+trace.json delete mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/network_activity@container+host+network_proxy+security_control+trace.json delete mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/process_activity@container+host+security_control+trace.json delete mode 100644 crates/openshell-ocsf-validate/schemas/v1.8.0/ssh_activity@container+host+security_control+trace.json diff --git a/crates/openshell-ocsf-validate/README.md b/crates/openshell-ocsf-validate/README.md index c1406eded9..98d6c717a8 100644 --- a/crates/openshell-ocsf-validate/README.md +++ b/crates/openshell-ocsf-validate/README.md @@ -16,39 +16,8 @@ crates/openshell-ocsf-validate/schemas/update.sh crates/openshell-ocsf-validate/ Without arguments, `schemas/update.sh` refetches every vendored schema. The schema server takes up to a few minutes per export. The build embeds every file under `schemas/v*/`, so tests need no source checkout at run time. -### Trace profile - -The OCSF 1.8.0 schema server exports the Trace profile for HTTP Activity and API Activity. For the other eight classes OpenShell emits, requesting `profiles=trace` returns a schema without a `trace` property. A successful HTTP response alone therefore does not establish Trace support. - -OpenShell extends the optional Trace profile to Base Event, Application Lifecycle, Authentication, Detection Finding, Device Config State Change, Network Activity, Process Activity, and SSH Activity. Those Trace schema variants contain a `$comment` that identifies the extension. They are official class exports plus an OpenShell extension, rather than unmodified official exports for those profile combinations. - -For these eight classes, `schemas/trace_schema.py` copies the `trace` property and its complete definition closure (`trace`, `span`, `service`, and `key_value_object`) unchanged from the [official HTTP Activity export](https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace). It preserves every other class constraint, including required fields and rejection of undefined attributes. It rejects conflicting shared definitions, malformed or unresolved Trace definitions, unsupported versions, and invalid profile names or ordering. HTTP/API variants retain their native Trace exports after the same definition checks. The validator still selects an exact profile combination; it does not accept arbitrary additional fields or profiles. - -Each of the 18 existing untraced profile combinations has a sibling with `+trace` in its name. To regenerate only these Trace variants from the repository root: - -```shell -trace_schemas=() -for schema in crates/openshell-ocsf-validate/schemas/v1.8.0/*.json; do - case "$schema" in *+trace.json) continue ;; esac - trace_schemas+=("${schema%.json}+trace.json") -done -crates/openshell-ocsf-validate/schemas/update.sh "${trace_schemas[@]}" -``` - -This leaves the existing untraced schemas untouched. The updater uses `uv` for its Python formatting and composition steps. Trace outputs sort JSON keys so repeated exports of the same schema content produce the same bytes. - -To reuse an already downloaded donor, set `OCSF_TRACE_SCHEMA_EXPORT` to the response file and `OCSF_TRACE_SCHEMA_SHA256` to its recorded SHA-256. The receipt must identify the exact OCSF 1.8.0 HTTP export URL above. The helper checks the hash and schema structure; it cannot independently establish the provenance or version of an arbitrary cache file because the schema server does not encode its version in `$id`. Preserve the download URL and response receipt alongside the hash. - -Run the composition safeguards without a Rust build: - -```shell -uv run --no-project python -m unittest discover -s crates/openshell-ocsf-validate/schemas -p 'test_trace_schema.py' -``` - ## Changing OCSF versions -Trace composition is deliberately restricted to OCSF 1.8.0. Review the newer version's profile applicability and definitions before updating `trace_schema.py` to permit it. - Each version's schemas live in their own directory, so a version change can land in steps: 1. Run `schemas/update.sh` with the current version's file names under `schemas/v/`. Events labelled with the current version still validate against its schemas. diff --git a/crates/openshell-ocsf-validate/schemas/test_trace_schema.py b/crates/openshell-ocsf-validate/schemas/test_trace_schema.py deleted file mode 100644 index b0e8b91cd6..0000000000 --- a/crates/openshell-ocsf-validate/schemas/test_trace_schema.py +++ /dev/null @@ -1,187 +0,0 @@ -# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -# SPDX-License-Identifier: Apache-2.0 - -"""Fail-closed and constraint-preservation checks for Trace schema composition.""" - -import contextlib -import copy -import hashlib -import io -import json -import sys -import tempfile -import unittest -from pathlib import Path -from unittest import mock - -from trace_schema import DRAFT, main, prepare_schema - - -def exported(class_name="http_activity", uid=4002, trace=True): - schema = { - "$schema": DRAFT, - "$id": "https://schema.ocsf.io/schema/classes/" + class_name, - "type": "object", - "additionalProperties": False, - "required": ["class_uid", "time"], - "properties": {"class_uid": {"const": uid}, "time": {"type": "integer"}}, - "$defs": {"unrelated": {"enum": ["preserve"]}}, - } - if trace: - schema["properties"]["trace"] = {"$ref": "#/$defs/trace", "title": "Trace"} - schema["$defs"].update( - { - "trace": { - "type": "object", - "additionalProperties": False, - "required": ["uid"], - "properties": { - "uid": {"type": "string"}, - "span": {"$ref": "#/$defs/span"}, - "service": {"$ref": "#/$defs/service"}, - }, - }, - "span": { - "properties": { - "tags": {"items": {"$ref": "#/$defs/key_value_object"}} - } - }, - "service": {"type": "object", "additionalProperties": False}, - "key_value_object": {"type": "object", "required": ["key", "value"]}, - } - ) - return schema - - -class TraceSchemaTests(unittest.TestCase): - def compose(self, base, donor=None, **kwargs): - return prepare_schema( - base, - donor if donor is not None else exported(), - kwargs.get("class_name", "network_activity"), - kwargs.get("version", "1.8.0"), - kwargs.get( - "profiles", - ["container", "host", "network_proxy", "security_control", "trace"], - ), - ) - - def test_extension_preserves_all_unrelated_constraints_and_inputs(self): - base = exported("network_activity", 4001, False) - donor = exported() - original = copy.deepcopy(base) - donor_original = copy.deepcopy(donor) - result = self.compose(base, donor) - self.assertIn("OpenShell extension", result.pop("$comment")) - self.assertEqual( - result["properties"].pop("trace"), donor["properties"]["trace"] - ) - for name in ["trace", "span", "service", "key_value_object"]: - self.assertEqual(result["$defs"].pop(name), donor["$defs"][name]) - self.assertEqual(result, original) - self.assertEqual(base, original) - self.assertEqual(donor, donor_original) - - def test_native_export_is_returned_without_extension(self): - native = exported("api_activity", 6003) - result = self.compose( - native, class_name="api_activity", profiles=["host", "trace"] - ) - self.assertEqual(result, native) - self.assertNotIn("$comment", result) - - def test_conflicting_shared_definition_is_rejected(self): - base = exported("network_activity", 4001, False) - base["$defs"]["service"] = {"type": "string"} - with self.assertRaisesRegex(ValueError, "conflicting shared definition"): - self.compose(base) - - def test_missing_or_widened_trace_definition_is_rejected(self): - for change in [ - "missing_uid", - "allow_extra", - "missing_span", - "external_reference", - ]: - with self.subTest(change=change): - donor = exported() - if change == "missing_uid": - donor["$defs"]["trace"]["required"] = [] - elif change == "allow_extra": - donor["$defs"]["trace"]["additionalProperties"] = True - elif change == "missing_span": - del donor["$defs"]["span"] - else: - donor["properties"]["trace"]["$ref"] = ( - "https://example.invalid/trace" - ) - with self.assertRaises(ValueError): - self.compose(exported("network_activity", 4001, False), donor) - - def test_wrong_class_version_and_profiles_are_rejected(self): - cases = [ - {"version": "1.9.0"}, - {"profiles": ["host", "invented", "trace"]}, - {"profiles": ["trace", "host"]}, - {"profiles": ["host", "trace", "trace"]}, - {"profiles": ["host"]}, - {"class_name": "base_event"}, - ] - for case in cases: - with self.subTest(case=case), self.assertRaises(ValueError): - self.compose(exported("network_activity", 4001, False), **case) - - def test_native_class_without_trace_and_changed_extension_applicability_fail(self): - with self.assertRaisesRegex(ValueError, "missing official Trace"): - self.compose( - exported("http_activity", 4002, False), class_name="http_activity" - ) - with self.assertRaisesRegex(ValueError, "now exports Trace natively"): - self.compose(exported("network_activity", 4001)) - - def test_cached_donor_requires_recorded_hash_and_matching_bytes(self): - with tempfile.TemporaryDirectory() as directory: - version = Path(directory) / "v1.8.0" - version.mkdir() - plain = version / "network_activity@host.json" - plain.write_text(json.dumps(exported("network_activity", 4001, False))) - target = version / "network_activity@host+trace.json" - donor = Path(directory) / "http.json" - donor.write_text(json.dumps(exported())) - argv = ["trace_schema.py", str(target), str(plain), str(donor)] - for expected in ["", "0" * 64]: - with ( - self.subTest(expected=expected), - mock.patch.object(sys, "argv", argv), - mock.patch.dict( - "os.environ", - { - "OCSF_TRACE_SCHEMA_EXPORT": str(donor), - "OCSF_TRACE_SCHEMA_SHA256": expected, - }, - ), - self.assertRaisesRegex(ValueError, "SHA-256|SHA256"), - ): - main() - output = io.StringIO() - with ( - mock.patch.object(sys, "argv", argv), - contextlib.redirect_stdout(output), - mock.patch.dict( - "os.environ", - { - "OCSF_TRACE_SCHEMA_EXPORT": str(donor), - "OCSF_TRACE_SCHEMA_SHA256": hashlib.sha256( - donor.read_bytes() - ).hexdigest(), - }, - ), - ): - main() - self.assertIn( - "OpenShell extension", json.loads(output.getvalue())["$comment"] - ) - - -if __name__ == "__main__": - unittest.main() diff --git a/crates/openshell-ocsf-validate/schemas/trace_schema.py b/crates/openshell-ocsf-validate/schemas/trace_schema.py deleted file mode 100644 index 55f54a2e51..0000000000 --- a/crates/openshell-ocsf-validate/schemas/trace_schema.py +++ /dev/null @@ -1,201 +0,0 @@ -# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -# SPDX-License-Identifier: Apache-2.0 - -"""Prepare Trace-profile exports without relaxing unrelated OCSF constraints. - -The server exports Trace on HTTP/API Activity only. Other supported classes use -an explicitly marked OpenShell extension composed from the official HTTP export. -Run through update.sh, which fetches both inputs for the requested OCSF version. -""" - -import copy -import hashlib -import json -import os -import sys -from pathlib import Path - -CLASS_UIDS = { - "api_activity": 6003, - "application_lifecycle": 6002, - "authentication": 3002, - "base_event": 0, - "detection_finding": 2004, - "device_config_state_change": 5019, - "http_activity": 4002, - "network_activity": 4001, - "process_activity": 1007, - "ssh_activity": 4007, -} -NATIVE_TRACE_CLASSES = {"api_activity", "http_activity"} -TRACE_DEFINITIONS = {"trace", "span", "service", "key_value_object"} -PROFILES = { - "ai_operation", - "container", - "host", - "network_proxy", - "security_control", - "trace", -} -DRAFT = "http://json-schema.org/draft-07/schema#" - - -def require(condition, message): - if not condition: - raise ValueError(message) - - -def references(value): - if isinstance(value, dict): - for key, child in value.items(): - if key == "$ref": - yield child - else: - yield from references(child) - elif isinstance(value, list): - for child in value: - yield from references(child) - - -def check_class(schema, name): - require(isinstance(schema, dict), "export must be a JSON object") - require(schema.get("$schema") == DRAFT, "unexpected JSON Schema draft") - require(schema.get("$id", "").endswith("/classes/" + name), "class ID URL mismatch") - require(schema.get("type") == "object", "event schema must describe an object") - require( - schema.get("additionalProperties") is False, - "event schema must reject undefined fields", - ) - require( - schema.get("properties", {}).get("class_uid", {}).get("const") - == CLASS_UIDS[name], - "class_uid mismatch", - ) - - -def trace_closure(schema): - prop = schema.get("properties", {}).get("trace") - require( - isinstance(prop, dict) and prop.get("$ref") == "#/$defs/trace", - "missing official Trace property", - ) - definitions = schema.get("$defs", {}) - found = set() - pending = list(references(prop)) - while pending: - ref = pending.pop() - require( - isinstance(ref, str) and ref.startswith("#/$defs/"), - "non-local Trace reference", - ) - name = ref[len("#/$defs/") :] - require(name in TRACE_DEFINITIONS, "unexpected Trace definition: " + name) - if name in found: - continue - require(name in definitions, "unresolved Trace reference: " + name) - found.add(name) - pending.extend(references(definitions[name])) - require(found == TRACE_DEFINITIONS, "incomplete official Trace definition closure") - trace = definitions["trace"] - require( - trace.get("type") == "object" and trace.get("additionalProperties") is False, - "malformed Trace object", - ) - require( - trace.get("properties", {}).get("uid", {}).get("type") == "string", - "Trace UID must be a string", - ) - require(trace.get("required") == ["uid"], "unexpected required Trace attributes") - return prop, {name: definitions[name] for name in sorted(found)} - - -def prepare_schema(schema, donor, class_name, version, profiles): - require(version == "1.8.0", "Trace composition is reviewed for OCSF 1.8.0 only") - require(class_name in CLASS_UIDS, "unsupported event class") - require(profiles == sorted(set(profiles)), "profiles must be unique and sorted") - require( - "trace" in profiles and set(profiles) <= PROFILES, - "unsupported Trace profile combination", - ) - require( - "ai_operation" not in profiles or class_name == "api_activity", - "AI profile requires API Activity", - ) - require( - "network_proxy" not in profiles - or class_name in {"http_activity", "network_activity"}, - "network proxy profile requires HTTP/Network Activity", - ) - check_class(schema, class_name) - check_class(donor, "http_activity") - trace_property, definitions = trace_closure(donor) - if class_name in NATIVE_TRACE_CLASSES: - native_property, native_definitions = trace_closure(schema) - require( - native_property == trace_property and native_definitions == definitions, - "native Trace export differs from the HTTP donor", - ) - return copy.deepcopy(schema) - require( - "trace" not in schema["properties"], - "class now exports Trace natively; review extension applicability", - ) - result = copy.deepcopy(schema) - result["properties"]["trace"] = copy.deepcopy(trace_property) - result_definitions = result.setdefault("$defs", {}) - for name, definition in definitions.items(): - require( - name not in result_definitions or result_definitions[name] == definition, - "conflicting shared definition: " + name, - ) - result_definitions[name] = copy.deepcopy(definition) - result["$comment"] = ( - "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for " - + class_name - + ". The optional trace property and its definition closure are copied unchanged from " - "https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. " - "All other class constraints are preserved. Regenerate with schemas/update.sh." - ) - return result - - -def main(): - require( - len(sys.argv) == 4, - "usage: trace_schema.py TARGET CLASS_EXPORT HTTP_TRACE_EXPORT", - ) - target, class_export, donor_export = map(Path, sys.argv[1:]) - require( - target.parent.name.startswith("v"), "target must name an OCSF version directory" - ) - require("@" in target.stem, "target must name its profiles") - class_name, profile_names = target.stem.split("@", 1) - profiles = profile_names.split("+") - untraced = target.with_name( - class_name + "@" + "+".join(p for p in profiles if p != "trace") + ".json" - ) - require( - untraced.is_file(), - "vendor the corresponding untraced profile combination first", - ) - if os.environ.get("OCSF_TRACE_SCHEMA_EXPORT"): - expected = os.environ.get("OCSF_TRACE_SCHEMA_SHA256", "") - require( - len(expected) == 64 and all(c in "0123456789abcdef" for c in expected), - "a cached donor requires OCSF_TRACE_SCHEMA_SHA256 from its source receipt", - ) - require( - hashlib.sha256(donor_export.read_bytes()).hexdigest() == expected, - "cached donor SHA-256 mismatch", - ) - schema = json.loads(class_export.read_text()) - donor = json.loads(donor_export.read_text()) - result = prepare_schema(schema, donor, class_name, target.parent.name[1:], profiles) - print(json.dumps(result, indent=2, sort_keys=True)) - - -if __name__ == "__main__": - try: - main() - except (ValueError, KeyError, TypeError) as error: - raise SystemExit("Trace schema generation failed: " + str(error)) from error diff --git a/crates/openshell-ocsf-validate/schemas/update.sh b/crates/openshell-ocsf-validate/schemas/update.sh index dca9bbbc63..3fbd2032ac 100755 --- a/crates/openshell-ocsf-validate/schemas/update.sh +++ b/crates/openshell-ocsf-validate/schemas/update.sh @@ -5,14 +5,11 @@ # Fetch vendored schemas from the OCSF schema server: the files given, which # need not exist yet, or every file under v*/. Each file is # `v/@+.json`. -# Trace variants use the native export or the documented OpenShell composition. set -euo pipefail -OCSF_SCHEMA_TOOL_DIR="$(cd "$(dirname "$0")" && pwd)" -export OCSF_SCHEMA_TOOL_DIR fetch() { set -euo pipefail - local file="$1" name version class profiles="" tmp formatted donor + local file="$1" name version class profiles="" tmp name="$(basename "$file" .json)" version="$(basename "$(dirname "$file")")" version="${version#v}" @@ -22,27 +19,12 @@ fetch() { profiles="${profiles//+/,}" fi tmp="$(mktemp)" - formatted="$(mktemp)" curl -sSfL --retry 3 --max-time 600 \ - "https://schema.ocsf.io/schema/${version}/classes/${class}?profiles=${profiles}" > "$tmp" - if [[ ",${profiles}," == *,trace,* ]]; then - donor="$(mktemp)" - if [[ -n "${OCSF_TRACE_SCHEMA_EXPORT:-}" ]]; then - cp "$OCSF_TRACE_SCHEMA_EXPORT" "$donor" - else - curl -sSfL --retry 3 --max-time 600 \ - "https://schema.ocsf.io/schema/${version}/classes/http_activity?profiles=container,host,network_proxy,security_control,trace" > "$donor" - fi - uv run --no-project python "$OCSF_SCHEMA_TOOL_DIR/trace_schema.py" \ - "$file" "$tmp" "$donor" > "$formatted" - rm -f "$donor" - else - uv run --no-project python -m json.tool --indent 2 "$tmp" > "$formatted" - fi - chmod 644 "$formatted" + "https://schema.ocsf.io/schema/${version}/classes/${class}?profiles=${profiles}" \ + | python3 -m json.tool --indent 2 > "$tmp" + chmod 644 "$tmp" mkdir -p "$(dirname "$file")" - mv "$formatted" "$file" - rm -f "$tmp" + mv "$tmp" "$file" echo "fetched v${version}/${name}" } export -f fetch diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json index 0bac20738b..873d9a449c 100644 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+security_control+trace.json @@ -1,11 +1,11 @@ { "$defs": { - "account": { + "kb_article": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "src_url" ] }, { @@ -14,152 +14,6 @@ ] } ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, "properties": { "avg_timespan": { "$ref": "#/$defs/timespan", @@ -177,10 +31,6 @@ "title": "Created Time", "type": "integer" }, - "desc": { - "title": "Description", - "type": "string" - }, "install_state": { "title": "Install State", "type": "string" @@ -200,10 +50,6 @@ "title": "The patch is superseded.", "type": "boolean" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "os": { "$ref": "#/$defs/os", "title": "OS" @@ -212,26 +58,9 @@ "$ref": "#/$defs/product", "title": "Product" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, "size": { "title": "Size", @@ -246,247 +75,238 @@ "type": "string" }, "uid": { - "title": "Advisory ID", + "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Advisory", + "title": "KB Article", "type": "object" }, - "affected_code": { + "long_string": { "additionalProperties": false, "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "start_column": { - "title": "Start Column", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "file" + "value" ], - "title": "Affected Code", + "title": "Long String", "type": "object" }, - "affected_package": { + "enrichment": { "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpe_name": { - "title": "The product CPE identifier", + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "fixed_in_version": { - "title": "Fixed In Version", + "provider": { + "title": "Provider", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "license": { - "title": "Software License", + "short_desc": { + "title": "Short Description", "type": "string" }, - "license_url": { - "title": "Software License URL", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "type": { + "title": "Type", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", "type": "string" }, - "path": { - "title": "Path", + "display_name": { + "title": "Display Name", "type": "string" }, - "purl": { - "title": "Package URL", + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", "type": "string" }, - "release": { - "title": "Software Release Details", + "given_name": { + "title": "Given Name", "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "hire_time": { + "title": "Hire Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "job_title": { + "title": "Job Title", "type": "string" }, - "type": { - "title": "Type", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", "type": "integer" }, - "uid": { - "title": "Package UID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "version": { - "title": "Version", + "surname": { + "title": "Surname", "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" } }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", + "title": "LDAP Person", "type": "object" }, - "agent": { + "email_auth": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Agent Name", + "dkim": { + "title": "DKIM Status", "type": "string" }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", + "dkim_domain": { + "title": "DKIM Domain", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" }, - "uid": { - "title": "Agent ID", + "dmarc": { + "title": "DMARC Status", "type": "string" }, - "uid_alt": { - "title": "Alternate Agent ID", + "dmarc_override": { + "title": "DMARC Override", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "dmarc_policy": { + "title": "DMARC Policy", "type": "string" }, - "version": { - "title": "Agent Version", + "spf": { + "title": "SPF Status", "type": "string" } }, - "title": "Agent", + "title": "Email Authentication", "type": "object" }, - "ai_model": { + "epss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "ai_provider": { - "title": "AI Provider", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "percentile": { + "title": "EPSS Percentile", + "type": "number" }, - "uid": { - "title": "Unique ID", + "score": { + "title": "EPPS Score", "type": "string" }, "version": { @@ -495,54 +315,35 @@ } }, "required": [ - "ai_provider" + "score" ], - "title": "AI Model", + "title": "EPSS", "type": "object" }, - "analytic": { + "device_hw_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", + "bios_manufacturer": { + "title": "BIOS Manufacturer", "type": "string" }, - "desc": { - "title": "Description", + "bios_ver": { + "title": "BIOS Version", "type": "string" }, - "name": { - "title": "Name", + "chassis": { + "title": "Chassis", "type": "string" }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", + "cpu_architecture": { + "title": "CPU Architecture", "type": "string" }, - "state_id": { + "cpu_architecture_id": { "enum": [ 0, 1, @@ -550,93 +351,111 @@ 3, 99 ], - "title": "State ID", + "title": "CPU Architecture ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", + "cpu_cores": { + "title": "CPU Cores", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "cpu_count": { + "title": "CPU Count", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" }, - "operation": { - "title": "Operation", + "cpu_type": { + "title": "Processor Type", "type": "string" }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" + "gpu_count": { + "title": "GPU Count", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" }, - "version": { - "title": "Version", + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "required": [ - "operation" - ], - "title": "API", + "title": "Device Hardware Info", "type": "object" }, - "application": { + "network_proxy": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -644,166 +463,89 @@ } ], "properties": { - "criticality": { - "title": "Business Criticality", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Application Description", + "uid": { + "title": "Unique ID", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "hostname": { - "title": "Hostname", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "name": { - "title": "Application Name", + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Application Relationship" + "instance_uid": { + "title": "Instance ID", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "mac": { + "title": "MAC Address", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "sbom": { - "$ref": "#/$defs/sbom", - "title": "Related SBOM" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Application Type", - "type": "string" - }, - "uid": { - "title": "Application ID", + "isp": { + "title": "ISP Name", "type": "string" }, - "uid_alt": { - "title": "Application Alternative ID", + "zone": { + "title": "Network Zone", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Application Version", + "name": { + "title": "Name", "type": "string" - } - }, - "title": "Application", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" }, - "email_addr": { - "title": "Email Address", - "type": "string" + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - "factor_type": { - "title": "Factor Type", + "svc_name": { + "title": "Service Name", "type": "string" }, - "factor_type_id": { + "type_id": { "enum": [ 0, 1, @@ -817,107 +559,37 @@ 9, 10, 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Factor Type ID", + "title": "Type ID", "type": "integer" }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", + "network_scope": { + "title": "Network Scope", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "security_questions": { + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { "items": { "type": "string" }, - "title": "Security Questions", + "title": "Intermediate IP Addresses", "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + "isp_org": { + "title": "ISP Org", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" }, "fingerprints": { "items": { @@ -926,128 +598,199 @@ "title": "Fingerprints", "type": "array" }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" + "vpc_uid": { + "title": "VPC UID", + "type": "string" }, - "issuer": { - "title": "Issuer Distinguished Name", + "domain": { + "title": "Domain", "type": "string" }, - "sans": { + "agent_list": { "items": { - "$ref": "#/$defs/san" + "$ref": "#/$defs/agent" }, - "title": "Subject Alternative Names", + "title": "Agent List", "type": "array" }, - "serial_number": { - "title": "Certificate Serial Number", + "ip": { + "title": "IP Address", "type": "string" }, - "subject": { - "title": "Subject Distinguished Name", + "hostname": { + "title": "Hostname", "type": "string" }, - "uid": { - "title": "Unique ID", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "version": { - "title": "Version", + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", + "title": "Network Proxy Endpoint", "type": "object" }, - "cis_control": { + "data_classification": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], "properties": { - "desc": { - "title": "Description", + "category": { + "title": "Category", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" }, - "version": { - "title": "Version", + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", + "status": { + "title": "Status", "type": "string" }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "required": [ - "type" - ], - "title": "Classifier Details", + "title": "Data Classification", "type": "object" }, - "cloud": { + "http_response": { "additionalProperties": false, "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" + "body_length": { + "title": "Response Body Length", + "type": "integer" }, - "cloud_partition": { - "title": "Cloud Partition", + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "project_uid": { - "title": "Project ID", - "type": "string" + "latency": { + "title": "Latency", + "type": "integer" }, - "provider": { - "title": "Cloud Provider", - "type": "string" + "length": { + "title": "Response Length", + "type": "integer" }, - "region": { - "title": "Region", + "message": { + "title": "Message", "type": "string" }, - "zone": { - "title": "Cloud Availability Zone", + "status": { + "title": "Status", "type": "string" } }, "required": [ - "provider" + "code" ], - "title": "Cloud", + "title": "HTTP Response", "type": "object" }, - "container": { + "resource_details": { "additionalProperties": false, "anyOf": [ { @@ -1062,13 +805,39 @@ } ], "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" }, "labels": { "items": { @@ -1077,34 +846,42 @@ "title": "Labels", "type": "array" }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "network_driver": { - "title": "Network Driver", + "namespace": { + "title": "Namespace", "type": "string" }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" }, - "runtime": { - "title": "Runtime", + "role": { + "title": "Role", "type": "string" }, - "size": { - "title": "Size", + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", "type": "integer" }, - "tag": { - "title": "Image Tag", - "type": "string" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -1112,279 +889,384 @@ "title": "Tags", "type": "array" }, + "type": { + "title": "Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" - } - }, - "title": "Container", + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", "type": "object" }, - "cve": { + "display": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "color_depth": { + "title": "Color Depth", "type": "integer" }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" + "physical_height": { + "title": "Physical Height", + "type": "integer" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" + "physical_width": { + "title": "Physical Width", + "type": "integer" }, - "cwe_url": { - "title": "CWE URL", + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "desc": { - "title": "Description", + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", "type": "string" }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "name": { + "title": "Name", + "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "protocol_name": { + "title": "Supported Protocol", + "type": "string" }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "rate_limit": { + "title": "Rate Limit", + "type": "integer" }, - "title": { - "title": "Title", - "type": "string" + "scim_group_schema": { + "title": "SCIM Group Schema" }, - "type": { - "title": "Vulnerability Type", - "type": "string" + "scim_user_schema": { + "title": "SCIM User Schema" }, - "uid": { - "title": "CVE ID", + "state": { + "title": "State", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" }, - "depth": { + "state_id": { "enum": [ - "Base", - "Environmental", - "Temporal" + 0, + 1, + 2, + 3, + 4, + 99 ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" + "title": "State ID", + "type": "integer" }, - "severity": { - "title": "Severity", + "uid": { + "title": "Unique ID", "type": "string" }, - "src_url": { - "title": "Source URL", + "uid_alt": { + "title": "External ID", "type": "string" }, - "vector_string": { - "title": "Vector String", + "url_string": { + "title": "SCIM Endpoint URL", "type": "string" }, "vendor_name": { - "title": "Vendor Name", + "title": "Service Provider", "type": "string" }, "version": { - "title": "Version", + "title": "SCIM Version", "type": "string" } }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", + "title": "SCIM", "type": "object" }, - "cwe": { + "programmatic_credential": { "additionalProperties": false, "properties": { - "caption": { - "title": "Caption", - "type": "string" + "last_used_time": { + "title": "Last Used Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "type": { + "title": "Type", "type": "string" }, "uid": { - "title": "CWE ID", + "title": "Unique ID", "type": "string" } }, "required": [ "uid" ], - "title": "CWE", + "title": "Programmatic Credential", "type": "object" }, - "d3f_tactic": { + "os": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "build": { + "title": "OS Build", "type": "string" }, - "src_url": { - "title": "Source URL", + "country": { + "title": "Country", "type": "string" }, - "uid": { - "title": "Unique ID", + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "sp_name": { + "title": "OS Service Pack", "type": "string" }, - "uid": { - "title": "Unique ID", + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "MITRE D3FEND\u2122 Technique", + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", "type": "object" }, - "d3fend": { + "tactic": { "additionalProperties": false, "anyOf": [ { "required": [ - "d3f_tactic" + "name" ] }, { "required": [ - "d3f_technique" + "uid" ] } ], "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" + "name": { + "title": "Name", + "type": "string" }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" + "src_url": { + "title": "Source URL", + "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "MITRE D3FEND\u2122", + "title": "MITRE Tactic", "type": "object" }, - "data_classification": { + "dns_answer": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" }, - { - "required": [ - "confidentiality_id" - ] + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" } + }, + "required": [ + "rdata" ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, "properties": { - "category": { - "title": "Category", + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", "type": "string" }, - "category_id": { + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { "enum": [ 0, 1, @@ -1393,114 +1275,247 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, 99 ], - "title": "Category ID", + "title": "Auth Protocol ID", "type": "integer" }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "duration_mins": { + "title": "SSO Session Duration", "type": "integer" }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" }, - "size": { - "title": "Size", + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "src_url": { - "title": "Source URL", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "status_details": { + "scopes": { "items": { "type": "string" }, - "title": "Status Details", + "title": "Scopes", "type": "array" }, - "status_id": { - "enum": [ - 0, - 1, - 2, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Data Classification", + "title": "Token", "type": "object" }, - "device": { + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "d3f_tactic" ] }, { "required": [ - "instance_uid" + "d3f_technique" ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" }, - { - "required": [ - "interface_name" - ] + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" }, - { - "required": [ - "interface_uid" - ] + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" }, - { - "required": [ - "ip" - ] + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ { "required": [ "name" @@ -1513,207 +1528,192 @@ } ], "properties": { - "agent_list": { + "countermeasures": { "items": { - "$ref": "#/$defs/agent" + "$ref": "#/$defs/d3fend" }, - "title": "Agent List", + "title": "Countermeasures", "type": "array" }, - "autoscale_uid": { - "title": "Autoscale UID", + "name": { + "title": "Name", "type": "string" }, - "boot_time": { - "title": "Boot Time", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "boot_uid": { - "title": "Boot UID", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + { + "required": [ + "country" + ] }, - "created_time": { - "title": "Created Time", - "type": "integer" + { + "required": [ + "postal_code" + ] }, - "desc": { - "title": "Description", + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", "type": "string" }, - "domain": { - "title": "Domain", + "city": { + "title": "City", "type": "string" }, - "eid": { - "title": "EID", + "continent": { + "title": "Continent", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { + "coordinates": { "items": { - "$ref": "#/$defs/group" + "type": "number" }, - "title": "Groups", + "title": "Coordinates", "type": "array" }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", + "country": { + "title": "Country", "type": "string" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", + "desc": { + "title": "Description", "type": "string" }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", + "geodetic_altitude": { + "title": "Geodetic Altitude", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "geohash": { + "title": "Geohash", "type": "string" }, - "ip": { - "title": "IP Address", + "horizontal_accuracy": { + "title": "Horizontal Accuracy", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", + "is_on_premises": { + "title": "On-Premises", "type": "boolean" }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "isp": { + "title": "ISP Name", + "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + "lat": { + "title": "Latitude", + "type": "number" }, - "mac": { - "title": "MAC Address", - "type": "string" + "long": { + "title": "Longitude", + "type": "number" }, - "mac_vendor": { - "title": "MAC Vendor", + "postal_code": { + "title": "Postal Code", "type": "string" }, - "meid": { - "title": "MEID", + "pressure_altitude": { + "title": "Pressure Altitude", "type": "string" }, - "model": { - "title": "Model", + "provider": { + "title": "Provider", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", + "region": { + "title": "Region", "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { "items": { - "$ref": "#/$defs/network_interface" + "$ref": "#/$defs/auth_factor" }, - "title": "Network Interfaces", + "title": "Authentication Factors", "type": "array" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "domain": { + "title": "Domain", + "type": "string" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "issuer": { + "title": "Issuer Details", + "type": "string" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "name": { + "title": "Name", + "type": "string" }, - "region": { - "title": "Region", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "risk_level": { - "title": "Risk Level", + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", "type": "string" }, - "risk_level_id": { + "state_id": { "enum": [ 0, 1, @@ -1722,26 +1722,45 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "subnet": { - "title": "Subnet", + "uid": { + "title": "Unique ID", "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "url_string": { + "title": "Configuration URL", "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] }, - "type": { - "title": "Type", + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", "type": "string" }, - "type_id": { + "ai_role_id": { "enum": [ 0, 1, @@ -1750,636 +1769,550 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "AI Role ID", "type": "integer" }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" + "application": { + "$ref": "#/$defs/application", + "title": "Application" }, - "uid": { - "title": "Unique ID", - "type": "string" + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" }, - "uid_alt": { - "title": "Alternate ID", + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "total_tokens": { + "title": "Total Tokens", + "type": "integer" }, - "zone": { - "title": "Network Zone", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Device", + "title": "Message Context", "type": "object" }, - "device_hw_info": { + "process": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "chassis": { - "title": "Chassis", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "cpu_architecture": { - "title": "CPU Architecture", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", "type": "string" }, - "cpu_architecture_id": { + "integrity_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, 99 ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", + "title": "Integrity Level", "type": "integer" }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" }, - "cpu_type": { - "title": "Processor Type", + "name": { + "title": "Name", "type": "string" }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" + "path": { + "title": "Path", + "type": "string" }, - "ram_size": { - "title": "RAM Size", + "pid": { + "title": "Process ID", "type": "integer" }, - "serial_number": { - "title": "Serial Number", - "type": "string" + "ptid": { + "title": "Process Thread ID", + "type": "integer" }, - "uuid": { - "title": "UUID", + "sandbox": { + "title": "Sandbox", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", + "terminated_time": { + "title": "Terminated Time", "type": "integer" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", + "tid": { + "title": "Thread ID", "type": "integer" }, - "developer_uid": { - "title": "Developer UID", + "uid": { + "title": "Unique ID", "type": "string" }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" + "user": { + "$ref": "#/$defs/user", + "title": "User" }, - "state": { - "title": "State", + "working_directory": { + "title": "Working Directory", "type": "string" }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" } }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", + "title": "Process", "type": "object" }, - "discovery_details": { + "vulnerability": { "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" + "required": [ + "advisory" + ] }, - "physical_width": { - "title": "Physical Width", - "type": "integer" + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, + ], "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" }, - "flag_ids": { + "affected_code": { "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" + "$ref": "#/$defs/affected_code" }, - "title": "DNS Header Flags", + "title": "Affected Code", "type": "array" }, - "flags": { + "affected_packages": { "items": { - "type": "string" + "$ref": "#/$defs/affected_package" }, - "title": "DNS Header Flags", + "title": "Affected Software Packages", "type": "array" }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", + "category": { + "title": "Category", "type": "string" }, - "ttl": { - "title": "TTL", - "type": "integer" + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" }, - "type": { - "title": "Resource Record Type", + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", + }, + "desc": { + "title": "Description", "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" }, - "name": { - "title": "Name", + "exploit_ref_url": { + "title": "Exploit URL", "type": "string" }, - "phone_number": { - "title": "Phone Number", + "exploit_requirement": { + "title": "Exploit Requirement", "type": "string" }, - "type": { - "title": "Domain Contact Type", + "exploit_type": { + "title": "Exploit Type", "type": "string" }, - "type_id": { + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, 99 ], - "title": "Domain Contact Type ID", + "title": "Fix Coverage ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "edge": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" }, - "is_directed": { - "title": "Directed", + "is_fix_available": { + "title": "Fix Availability", "type": "boolean" }, - "name": { - "title": "Name", - "type": "string" + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" }, - "relation": { - "title": "Relation", - "type": "string" + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" }, - "source": { - "title": "Source", - "type": "string" + "last_seen_time": { + "title": "Last Seen", + "type": "integer" }, - "target": { - "title": "Target", - "type": "string" + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "source", - "target" - ], - "title": "Edge", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { + "references": { "items": { "type": "string" }, - "title": "Cc", + "title": "References", "type": "array" }, - "cc_mailboxes": { + "related_vulnerabilities": { "items": { "type": "string" }, - "title": "Cc Mailboxes", + "title": "Related Vulnerability IDs", "type": "array" }, - "delivered_to": { - "title": "Delivered To", - "type": "string" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" + "title": { + "title": "Title", + "type": "string" }, - "from": { - "title": "From", + "vendor_name": { + "title": "Vendor Name", "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" + "end_line": { + "title": "End Line", + "type": "integer" }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "is_read": { - "title": "Read", - "type": "boolean" + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" }, - "message_uid": { - "title": "Message UID", + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", "type": "string" }, - "raw_header": { - "title": "Raw Header", + "keyboard_layout": { + "title": "Keyboard Layout", "type": "string" }, - "reply_to": { - "title": "Reply To", + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" }, - "reply_to_list": { + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { "items": { - "type": "string" + "$ref": "#/$defs/fingerprint" }, - "title": "Reply To List", + "title": "Fingerprints", "type": "array" }, - "reply_to_mailboxes": { + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { "items": { - "type": "string" + "$ref": "#/$defs/san" }, - "title": "Reply To Mailboxes", + "title": "Subject Alternative Names", "type": "array" }, - "return_path": { - "title": "Return Path", + "serial_number": { + "title": "Certificate Serial Number", "type": "string" }, - "sender": { - "title": "Sender", + "subject": { + "title": "Subject Distinguished Name", "type": "string" }, - "sender_mailbox": { - "title": "Sender Mailbox", + "uid": { + "title": "Unique ID", "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "smtp_from": { - "title": "SMTP From", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", "type": "string" }, - "smtp_to": { + "edges": { "items": { - "type": "string" + "$ref": "#/$defs/edge" }, - "title": "SMTP To", + "title": "Edges", "type": "array" }, - "subject": { - "title": "Subject", - "type": "string" + "is_directed": { + "title": "Directed", + "type": "boolean" }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "to_mailboxes": { + "nodes": { "items": { - "type": "string" + "$ref": "#/$defs/node" }, - "title": "To Mailboxes", + "title": "Nodes", "type": "array" }, - "uid": { - "title": "Email Thread UID", + "query_language": { + "title": "Query Language", "type": "string" }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { + "query_language_id": { "enum": [ 0, 1, @@ -2388,124 +2321,127 @@ 4, 5, 6, + 7, 99 ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", + "title": "Query Language ID", "type": "integer" }, - "key_uid": { - "title": "Key UID", + "type": { + "title": "Type", "type": "string" }, - "type": { - "title": "Encryption Type", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Encryption Details", + "required": [ + "nodes" + ], + "title": "Graph", "type": "object" }, - "enrichment": { + "account": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" + "is_disabled": { + "title": "Disabled", + "type": "boolean" }, - "data": { - "title": "Data" + "is_locked": { + "title": "Locked", + "type": "boolean" }, - "desc": { - "title": "Description", - "type": "string" + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "type": { "title": "Type", "type": "string" }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", + "title": "Account", "type": "object" }, - "epss": { + "authorization": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", + "decision": { + "title": "Authorization Decision/Outcome", "type": "string" }, - "version": { - "title": "Version", - "type": "string" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" } }, - "required": [ - "score" - ], - "title": "EPSS", + "title": "Authorization Result", "type": "object" }, - "extension": { + "autonomous_system": { "additionalProperties": false, "anyOf": [ { @@ -2515,7 +2451,7 @@ }, { "required": [ - "uid" + "number" ] } ], @@ -2524,211 +2460,148 @@ "title": "Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" + "number": { + "title": "Number", + "type": "integer" } }, - "required": [ - "version" - ], - "title": "Schema Extension", + "title": "Autonomous System", "type": "object" }, - "feature": { + "classifier_details": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { "name": { "title": "Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "type": { + "title": "Type", + "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Feature", + "required": [ + "type" + ], + "title": "Classifier Details", "type": "object" }, - "file": { + "session": { "additionalProperties": false, "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "count": { + "title": "Count", "type": "integer" }, "created_time": { "title": "Created Time", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "drive_type": { - "title": "Drive Type", + "expiration_reason": { + "title": "Expiration Reason", "type": "string" }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", + "is_mfa": { + "title": "Multi Factor Authentication", "type": "boolean" }, - "is_encrypted": { - "title": "Encrypted", + "is_remote": { + "title": "Remote", "type": "boolean" }, - "is_readonly": { - "title": "Read-Only", + "is_vpn": { + "title": "VPN Session", "type": "boolean" }, - "is_system": { - "title": "System", - "type": "boolean" + "issuer": { + "title": "Issuer Details", + "type": "string" }, - "mime_type": { - "title": "MIME type", + "terminal": { + "title": "Terminal", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "uid": { + "title": "Unique ID", + "type": "string" }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "name": { "title": "Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "src_url": { + "title": "Source URL", + "type": "string" }, - "parent_folder": { - "title": "Parent Folder", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", "type": "string" }, "path": { "title": "Path", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", + "tag": { + "title": "Image Tag", "type": "string" }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -2736,106 +2609,18 @@ "title": "Tags", "type": "array" }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, "uid": { "title": "Unique ID", "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, "required": [ - "name", - "type_id" + "uid" ], - "title": "File", + "title": "Image", "type": "object" }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { + "application": { "additionalProperties": false, "anyOf": [ { @@ -2850,163 +2635,130 @@ } ], "properties": { - "category": { - "title": "Category", + "criticality": { + "title": "Business Criticality", "type": "string" }, - "condition": { - "title": "Condition", - "type": "string" + "data": { + "title": "Data" }, "desc": { - "title": "Description", + "title": "Application Description", "type": "string" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "match_details": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { "items": { "type": "string" }, - "title": "Match Details", + "title": "Labels", "type": "array" }, - "match_location": { - "title": "Match Location", - "type": "string" - }, "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", + "title": "Application Name", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "uid": { - "title": "Unique ID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "bus_type_id": { + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, - 7, 99 ], - "title": "Bus Type ID", + "title": "Risk Level ID", "type": "integer" }, - "cores": { - "title": "Cores", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "model": { - "title": "Model", + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "uid": { + "title": "Application ID", "type": "string" }, - "vram_mode": { - "title": "VRAM Mode", + "uid_alt": { + "title": "Application Alternative ID", "type": "string" }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" + "version": { + "title": "Application Version", + "type": "string" } }, - "title": "GPU Information", + "title": "Application", "type": "object" }, - "graph": { + "script": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "desc": { - "title": "Description", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "edges": { + "hashes": { "items": { - "$ref": "#/$defs/edge" + "$ref": "#/$defs/fingerprint" }, - "title": "Edges", + "title": "Hashes", "type": "array" }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, "name": { "title": "Name", "type": "string" }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" }, - "query_language": { - "title": "Query Language", + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", "type": "string" }, - "query_language_id": { + "type_id": { "enum": [ 0, 1, @@ -3018,207 +2770,141 @@ 7, 99 ], - "title": "Query Language ID", + "title": "Type ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" } }, "required": [ - "nodes" + "script_content", + "type_id" ], - "title": "Graph", + "title": "Script", "type": "object" }, - "group": { + "affected_package": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "desc": { - "title": "Description", + "architecture": { + "title": "Architecture", "type": "string" }, - "domain": { - "title": "Domain", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "name": { - "title": "Name", + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", "type": "string" }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "type": { - "title": "Group Type", + "license": { + "title": "Software License", "type": "string" }, - "uid": { - "title": "Unique ID", + "license_url": { + "title": "Software License URL", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "package_manager": { + "title": "Package Manager", "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "http_request": { - "additionalProperties": false, - "properties": { - "args": { - "title": "HTTP Arguments", + }, + "package_manager_url": { + "title": "Package Manager URL", "type": "string" }, - "body_length": { - "title": "Request Body Length", - "type": "integer" + "path": { + "title": "Path", + "type": "string" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "purl": { + "title": "Package URL", + "type": "string" }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", + "release": { + "title": "Software Release Details", "type": "string" }, - "length": { - "title": "Request Length", - "type": "integer" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "referrer": { - "title": "HTTP Referrer", + "src_url": { + "title": "Source URL", "type": "string" }, - "uid": { - "title": "Unique ID", + "type": { + "title": "Type", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "user_agent": { - "title": "HTTP User-Agent", + "uid": { + "title": "Package UID", "type": "string" }, - "version": { - "title": "HTTP Version", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" + "version": { + "title": "Version", + "type": "string" } }, - "title": "HTTP Request", + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", "type": "object" }, - "http_response": { + "cis_control": { "additionalProperties": false, "properties": { - "body_length": { - "title": "Response Body Length", - "type": "integer" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "content_type": { - "title": "HTTP Content Type", + "desc": { + "title": "Description", "type": "string" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" - }, - "length": { - "title": "Response Length", - "type": "integer" - }, - "message": { - "title": "Message", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "version": { + "title": "Version", "type": "string" } }, "required": [ - "code" + "name" ], - "title": "HTTP Response", + "title": "CIS Control", "type": "object" }, - "idp": { + "analytic": { "additionalProperties": false, "anyOf": [ { @@ -3233,44 +2919,28 @@ } ], "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" + "category": { + "title": "Category", + "type": "string" }, - "issuer": { - "title": "Issuer Details", + "desc": { + "title": "Description", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" }, "state": { "title": "State", @@ -3282,56 +2952,86 @@ 1, 2, 3, - 4, 99 ], "title": "State ID", "type": "integer" }, - "tenant_uid": { - "title": "Tenant UID", + "type": { + "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" }, - "url_string": { - "title": "Configuration URL", + "version": { + "title": "Version", "type": "string" } }, - "title": "Identity Provider", + "required": [ + "type_id" + ], + "title": "Analytic", "type": "object" }, - "image": { + "edge": { "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "relation": { + "title": "Relation", "type": "string" }, - "tag": { - "title": "Image Tag", + "source": { + "title": "Source", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "target": { + "title": "Target", + "type": "string" }, "uid": { "title": "Unique ID", @@ -3339,165 +3039,219 @@ } }, "required": [ - "uid" + "source", + "target" ], - "title": "Image", + "title": "Edge", "type": "object" }, - "kb_article": { + "actor": { "additionalProperties": false, "anyOf": [ { "required": [ - "src_url" + "app_name" ] }, { "required": [ - "uid" + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" ] } ], "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", + "app_name": { + "title": "Application Name", "type": "string" }, - "classification": { - "title": "Classification", + "app_uid": { + "title": "Application ID", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" }, - "install_state": { - "title": "Install State", + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", "type": "string" }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" + "process": { + "$ref": "#/$defs/process", + "title": "Process" }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" }, - "severity": { - "title": "Severity", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "provider": { + "title": "Cloud Provider", + "type": "string" }, - "src_url": { - "title": "Source URL", + "region": { + "title": "Region", "type": "string" }, - "title": { - "title": "Title", + "zone": { + "title": "Cloud Availability Zone", "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "KB Article", + "required": [ + "uid" + ], + "title": "Trace", "type": "object" }, - "key_value_object": { + "ai_model": { "additionalProperties": false, "anyOf": [ { "required": [ - "value" + "name" ] }, { "required": [ - "values" + "uid" ] } ], "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "name" + "ai_provider" ], - "title": "Key:Value object", + "title": "AI Model", "type": "object" }, - "keyboard_info": { + "file": { "additionalProperties": false, "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", + "parent_folder": { + "title": "Parent Folder", "type": "string" }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" + "is_system": { + "title": "System", + "type": "boolean" }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { + "confidentiality_id": { "enum": [ 0, 1, @@ -3506,111 +3260,97 @@ 4, 5, 6, - 7, 99 ], - "title": "Kill Chain Phase ID", + "title": "Confidentiality ID", "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", + }, + "uid": { + "title": "Unique ID", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" }, - "deleted_time": { - "title": "Deleted Time", + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "department": { - "title": "Department", + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", "type": "string" }, - "display_name": { - "title": "Display Name", + "company_name": { + "title": "Company Name", "type": "string" }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" + "attributes": { + "title": "Attributes", + "type": "integer" }, - "employee_uid": { - "title": "Employee ID", + "desc": { + "title": "Description", "type": "string" }, - "given_name": { - "title": "Given Name", + "type": { + "title": "Type", "type": "string" }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", + "path": { + "title": "Path", "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "uri": { + "title": "File URI", + "type": "string" }, - "last_login_time": { - "title": "Last Login", - "type": "integer" + "is_deleted": { + "title": "Deleted", + "type": "boolean" }, - "ldap_cn": { - "title": "LDAP Common Name", + "confidentiality": { + "title": "Confidentiality", "type": "string" }, - "ldap_dn": { - "title": "LDAP Distinguished Name", + "drive_type": { + "title": "Drive Type", "type": "string" }, - "leave_time": { - "title": "Leave Time", + "created_time": { + "title": "Created Time", "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" }, - "office_location": { - "title": "Office Location", - "type": "string" + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" }, - "phone_number": { - "title": "Telephone Number", + "name": { + "title": "Name", "type": "string" }, - "surname": { - "title": "Surname", - "type": "string" + "accessed_time": { + "title": "Accessed Time", + "type": "integer" }, "tags": { "items": { @@ -3618,275 +3358,182 @@ }, "title": "Tags", "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] }, - { - "required": [ - "country" - ] + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" }, - { - "required": [ - "postal_code" - ] + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" + "size": { + "title": "Size", + "type": "integer" }, - "city": { - "title": "City", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "continent": { - "title": "Continent", + "internal_name": { + "title": "Internal Name", "type": "string" }, - "coordinates": { + "hashes": { "items": { - "type": "number" + "$ref": "#/$defs/fingerprint" }, - "title": "Coordinates", + "title": "Hashes", "type": "array" }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" }, - "geodetic_altitude": { - "title": "Geodetic Altitude", + "security_descriptor": { + "title": "Security Descriptor", "type": "string" }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", + "volume": { + "title": "Volume", "type": "string" }, - "geohash": { - "title": "Geohash", - "type": "string" + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", + "mime_type": { + "title": "MIME type", "type": "string" }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" }, "product": { "$ref": "#/$defs/product", "title": "Product" }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Logger", + "required": [ + "name", + "type_id" + ], + "title": "File", "type": "object" }, - "long_string": { + "remediation": { "additionalProperties": false, "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" }, - "value": { - "title": "Value", + "desc": { + "title": "Description", "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" } }, "required": [ - "value" + "desc" ], - "title": "Long String", + "title": "Remediation", "type": "object" }, - "malware": { + "email": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "from" ] }, { "required": [ - "uid" + "to" ] } ], "properties": { - "classification_ids": { + "cc": { "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" + "type": "string" }, - "title": "Classification IDs", + "title": "Cc", "type": "array" }, - "classifications": { + "cc_mailboxes": { "items": { "type": "string" }, - "title": "Classifications", + "title": "Cc Mailboxes", "type": "array" }, - "cves": { + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { "items": { - "$ref": "#/$defs/cve" + "type": "string" }, - "title": "CVE List", + "title": "Delivered To List", "type": "array" }, "files": { @@ -3896,384 +3543,380 @@ "title": "Files", "type": "array" }, - "name": { - "title": "Name", + "from": { + "title": "From", "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" }, - "path": { - "title": "Path", + "from_mailbox": { + "title": "From Mailbox", "type": "string" }, - "provider": { - "title": "Provider", + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", "type": "string" }, - "severity": { - "title": "Severity", + "raw_header": { + "title": "Raw Header", "type": "string" }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "reply_to": { + "title": "Reply To", "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" }, - "name": { - "title": "Name", - "type": "string" + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" }, - "num_files": { - "title": "Scanned Files", - "type": "integer" + "return_path": { + "title": "Return Path", + "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" + "sender": { + "title": "Sender", + "type": "string" }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" }, "size": { "title": "Size", "type": "integer" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "smtp_from": { + "title": "SMTP From", + "type": "string" }, - "type": { - "title": "Type", + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" }, "uid": { - "title": "Scan UID", + "title": "Email Thread UID", "type": "string" }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "type_id" + "name", + "value" ], - "title": "Malware Scan Info", + "title": "Environment Variable", "type": "object" }, - "message_context": { + "technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "application" + "name" ] }, { "required": [ - "service" + "uid" ] } ], "properties": { - "ai_role": { - "title": "AI Role", - "type": "string" - }, - "ai_role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "AI Role ID", - "type": "integer" - }, - "application": { - "$ref": "#/$defs/application", - "title": "Application" - }, - "completion_tokens": { - "title": "Completion Tokens", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "prompt_tokens": { - "title": "Prompt Tokens", - "type": "integer" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "total_tokens": { - "title": "Total Tokens", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "Message Context", + "title": "MITRE Technique", "type": "object" }, - "metadata": { + "http_request": { "additionalProperties": false, "properties": { - "correlation_uid": { - "title": "Correlation UID", + "args": { + "title": "HTTP Arguments", "type": "string" }, - "debug": { + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { "items": { - "type": "string" + "$ref": "#/$defs/http_header" }, - "title": "Debug Information", + "title": "HTTP Headers", "type": "array" }, - "event_code": { - "title": "Event Code", + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", "type": "string" }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" + "length": { + "title": "Request Length", + "type": "integer" }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" + "referrer": { + "title": "HTTP Referrer", + "type": "string" }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "uid": { + "title": "Unique ID", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "log_source": { - "title": "Log Source", + "user_agent": { + "title": "HTTP User-Agent", "type": "string" }, - "log_version": { - "title": "Log Version", + "version": { + "title": "HTTP Version", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { + "x_forwarded_for": { "items": { - "$ref": "#/$defs/logger" + "type": "string" }, - "title": "Loggers", + "title": "X-Forwarded-For", "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", "type": "string" }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { + "metrics": { "items": { - "type": "string" + "$ref": "#/$defs/metric" }, - "title": "Profiles", + "title": "Metrics", "type": "array" }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" + "overall_score": { + "title": "Overall Score", + "type": "number" }, - "source": { - "title": "Source", + "severity": { + "title": "Severity", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", + "src_url": { + "title": "Source URL", "type": "string" }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", + "vector_string": { + "title": "Vector String", "type": "string" }, - "uid": { - "title": "Event UID", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, "required": [ - "product", + "base_score", "version" ], - "title": "Metadata", + "title": "CVSS Score", "type": "object" }, - "metric": { + "fingerprint": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", + "algorithm": { + "title": "Algorithm", "type": "string" }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, "value": { "title": "Value", "type": "string" } }, "required": [ - "name", + "algorithm_id", "value" ], - "title": "Metric", + "title": "Fingerprint", "type": "object" }, - "mitigation": { + "process_entity": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, { "required": [ "uid" @@ -4281,270 +3924,290 @@ } ], "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "path": { + "title": "Path", "type": "string" }, + "pid": { + "title": "Process ID", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "MITRE Mitigation", + "title": "Process Entity", "type": "object" }, - "network_endpoint": { + "observable": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" }, - { - "required": [ - "hostname" - ] + "name": { + "title": "Name", + "type": "string" }, - { - "required": [ - "instance_uid" - ] + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - { - "required": [ - "interface_name" - ] + "type": { + "title": "Type", + "type": "string" }, - { - "required": [ - "interface_uid" - ] + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" }, - { - "required": [ - "ip" - ] + "type_uid": { + "title": "Type ID", + "type": "integer" }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "name" + "sub_technique" ] }, { "required": [ - "svc_name" + "tactic" ] }, { "required": [ - "uid" + "technique" ] } ], "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" }, - "domain": { - "title": "Domain", - "type": "string" + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" }, - "fingerprints": { + "tactics": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/tactic" }, - "title": "Fingerprints", + "title": "Tactics", "type": "array" }, - "hostname": { - "title": "Hostname", + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + { + "required": [ + "ip" + ] }, - "instance_uid": { - "title": "Instance ID", - "type": "string" + { + "required": [ + "mac" + ] }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" + { + "required": [ + "name" + ] }, - "interface_uid": { - "title": "Network Interface ID", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", "type": "string" }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, "ip": { "title": "IP Address", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, "mac": { "title": "MAC Address", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", "type": "integer" }, - "network_scope": { - "title": "Network Scope", + "type": { + "title": "Type", "type": "string" }, - "network_scope_id": { + "type_id": { "enum": [ 0, 1, 2, + 3, + 4, 99 ], - "title": "Network Scope ID", + "title": "Type ID", "type": "integer" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] }, { "required": [ @@ -4558,35 +4221,86 @@ } ], "properties": { - "hostname": { - "title": "Hostname", + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "ip": { - "title": "IP Address", + "display_name": { + "title": "Display Name", "type": "string" }, - "mac": { - "title": "MAC Address", + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", "type": "string" }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, "name": { "title": "Name", "type": "string" }, - "namespace": { - "title": "Namespace", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "open_ports": { + "programmatic_credentials": { "items": { - "$ref": "#/$defs/port_info" + "$ref": "#/$defs/programmatic_credential" }, - "title": "Open Ports", + "title": "Programmatic Credentials", "type": "array" }, - "subnet_prefix": { - "title": "Subnet Prefix Length", + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", "type": "integer" }, "type": { @@ -4608,191 +4322,264 @@ "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "title": "Network Interface", + "title": "User", "type": "object" }, - "network_proxy": { + "auth_factor": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - { - "required": [ - "hostname" - ] + "email_addr": { + "title": "Email Address", + "type": "string" }, - { - "required": [ - "instance_uid" - ] + "factor_type": { + "title": "Factor Type", + "type": "string" }, - { - "required": [ - "interface_name" - ] + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" }, - { - "required": [ - "interface_uid" - ] + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" }, - { - "required": [ - "ip" - ] + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" }, - { - "required": [ - "name" - ] + "phone_number": { + "title": "Phone Number", + "type": "string" }, - { - "required": [ - "svc_name" - ] + "provider": { + "title": "Provider", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { + "security_questions": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "Security Questions", "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { "items": { - "$ref": "#/$defs/fingerprint" + "type": "string" }, - "title": "Fingerprints", + "title": "References", "type": "array" }, - "hostname": { - "title": "Hostname", + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" }, - "instance_uid": { - "title": "Instance ID", + "detection_pattern": { + "title": "Detection Pattern", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "category": { + "title": "Category", "type": "string" }, - "intermediate_ips": { + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { "items": { "type": "string" }, - "title": "Intermediate IP Addresses", + "title": "Related Subdomains", "type": "array" }, - "ip": { - "title": "IP Address", + "confidence": { + "title": "Confidence", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "isp_org": { - "title": "ISP Org", + "type": { + "title": "Type", "type": "string" }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, "location": { "$ref": "#/$defs/location", "title": "Geo Location" }, - "mac": { - "title": "MAC Address", + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", "type": "string" }, - "name": { - "title": "Name", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "network_scope": { - "title": "Network Scope", + "name": { + "title": "Name", "type": "string" }, - "network_scope_id": { + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", + "title": "Detection Pattern Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", + "detection_pattern_type": { + "title": "Detection Pattern", "type": "string" }, - "svc_name": { - "title": "Service Name", - "type": "string" + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" }, "type_id": { "enum": [ @@ -4811,155 +4598,105 @@ 12, 13, 14, - 15, 99 ], - "title": "Type ID", + "title": "Indicator Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" }, - "zone": { - "title": "Network Zone", + "severity": { + "title": "Severity", "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "node": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" }, - "desc": { - "title": "Description", - "type": "string" + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" }, - "name": { - "title": "Name", + "src_url": { + "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "subnet": { + "title": "Related Subnet", "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" } }, "required": [ - "uid" + "type_id", + "value" ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", + "title": "OSINT", "type": "object" }, - "observable": { + "san": { "additionalProperties": false, "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, "type": { "title": "Type", "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" } }, "required": [ - "type_id" + "name", + "type" ], - "title": "Observable", + "title": "Subject Alternative Name", "type": "object" }, "occurrence_details": { @@ -5052,7 +4789,7 @@ "title": "Occurrence Details", "type": "object" }, - "organization": { + "firewall_rule": { "additionalProperties": false, "anyOf": [ { @@ -5067,69 +4804,142 @@ } ], "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "ou_name": { - "title": "Org Unit Name", + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", "type": "string" }, - "ou_uid": { - "title": "Org Unit ID", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Organization", + "title": "Firewall Rule", "type": "object" }, - "os": { + "threat_actor": { "additionalProperties": false, "properties": { - "build": { - "title": "OS Build", + "name": { + "title": "Name", "type": "string" }, - "country": { - "title": "Country", + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", "type": "string" }, "cpe_name": { "title": "The product CPE identifier", "type": "string" }, - "cpu_bits": { - "title": "CPU Bits", + "epoch": { + "title": "Epoch", "type": "integer" }, - "edition": { - "title": "OS Edition", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "kernel_release": { - "title": "Kernel Release", + "license": { + "title": "Software License", "type": "string" }, - "lang": { - "title": "Language", + "license_url": { + "title": "Software License URL", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "sp_name": { - "title": "OS Service Pack", + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, "type": { "title": "Type", "type": "string" @@ -5137,21 +4947,21 @@ "type_id": { "enum": [ 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 + 1, + 2, + 99 ], "title": "Type ID", "type": "integer" }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, "version": { "title": "Version", "type": "string" @@ -5159,184 +4969,349 @@ }, "required": [ "name", - "type_id" + "version" ], - "title": "Operating System (OS)", + "title": "Software Package", "type": "object" }, - "osint": { + "transformation_info": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" + "lang": { + "title": "Language", + "type": "string" }, - "attacks": { + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", + "type": "integer" + }, + "containers": { "items": { - "$ref": "#/$defs/attack" + "$ref": "#/$defs/container" }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "title": "Containers", "type": "array" }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" + "data": { + "title": "Data" }, - "category": { - "title": "Category", + "error": { + "title": "Error Code", "type": "string" }, - "comment": { - "title": "Analyst Comments", + "error_message": { + "title": "Error Message", "type": "string" }, - "confidence": { - "title": "Confidence", - "type": "string" + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "created_time": { - "title": "Created Time", - "type": "integer" + { + "required": [ + "ip" + ] }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" + { + "required": [ + "name" + ] }, - "desc": { - "title": "Description", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", "type": "string" }, - "detection_pattern": { - "title": "Detection Pattern", + "ip": { + "title": "IP Address", "type": "string" }, - "detection_pattern_type": { - "title": "Detection Pattern", + "name": { + "title": "Name", "type": "string" }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "domain": { + "title": "Domain", + "type": "string" }, - "external_uid": { - "title": "External ID", + "hostname": { + "title": "Hostname", "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" + "path": { + "title": "Path", + "type": "string" }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" + "port": { + "title": "Port", + "type": "integer" }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" + "query_string": { + "title": "HTTP Query String", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "resource_type": { + "title": "Resource Type", + "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + "scheme": { + "title": "Scheme", + "type": "string" }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" + "subdomain": { + "title": "Subdomain", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "name": { "title": "Name", "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" + "uid": { + "title": "Unique ID", + "type": "string" }, - "severity": { - "title": "Severity", + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", "type": "string" }, - "severity_id": { + "bus_type_id": { "enum": [ 0, 1, @@ -5345,196 +5320,268 @@ 4, 5, 6, + 7, 99 ], - "title": "Severity ID", + "title": "Bus Type ID", "type": "integer" }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" + "cores": { + "title": "Cores", + "type": "integer" }, - "subnet": { - "title": "Related Subnet", + "model": { + "title": "Model", "type": "string" }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "type": { - "title": "Type", + "vram_mode": { + "title": "VRAM Mode", "type": "string" }, - "type_id": { + "vram_mode_id": { "enum": [ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, 99 ], - "title": "Indicator Type ID", + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "uid": { "title": "Unique ID", "type": "string" }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" }, "value": { - "title": "Indicator", + "title": "Value", "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "data": { + "title": "Data" }, - "vulnerabilities": { + "flags": { "items": { - "$ref": "#/$defs/vulnerability" + "type": "string" }, - "title": "Related Vulnerabilities", + "title": "Flags", "type": "array" }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" + "uid": { + "title": "Unique ID", + "type": "string" } }, "required": [ - "type_id", - "value" + "uid" ], - "title": "OSINT", + "title": "Request Elements", "type": "object" }, - "package": { + "sub_technique": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "architecture": { - "title": "Architecture", + "name": { + "title": "Name", "type": "string" }, - "cpe_name": { - "title": "The product CPE identifier", + "src_url": { + "title": "Source URL", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "hash": { "$ref": "#/$defs/fingerprint", "title": "Hash" }, - "license": { - "title": "Software License", - "type": "string" + "image": { + "$ref": "#/$defs/image", + "title": "Image" }, - "license_url": { - "title": "Software License URL", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", + "network_driver": { + "title": "Network Driver", "type": "string" }, - "release": { - "title": "Software Release Details", + "orchestrator": { + "title": "Orchestrator", "type": "string" }, - "src_url": { - "title": "Source URL", + "pod_uuid": { + "title": "Pod UUID", "type": "string" }, - "type": { - "title": "Type", + "runtime": { + "title": "Runtime", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "size": { + "title": "Size", "type": "integer" }, - "uid": { - "title": "Package UID", + "tag": { + "title": "Image Tag", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "name", - "version" - ], - "title": "Software Package", + "title": "Container", "type": "object" }, - "policy": { + "malware": { "additionalProperties": false, "anyOf": [ { @@ -5542,11 +5589,6 @@ "name" ] }, - { - "required": [ - "type" - ] - }, { "required": [ "uid" @@ -5554,242 +5596,352 @@ } ], "properties": { - "data": { - "title": "Data" + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" }, - "desc": { - "title": "Description", - "type": "string" + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" }, - "is_applied": { - "title": "Applied", - "type": "boolean" + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "path": { + "title": "Path", "type": "string" }, - "version": { - "title": "Version", + "provider": { + "title": "Provider", "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" }, - "protocol_name": { - "title": "Protocol Name", + "severity": { + "title": "Severity", "type": "string" }, - "protocol_num": { - "title": "Protocol Number", + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" } }, "required": [ - "port" + "classification_ids" ], - "title": "Port Information", + "title": "Malware", "type": "object" }, - "process": { + "win_win_service": { "additionalProperties": false, "anyOf": [ { "required": [ - "cpid" + "cmd_line" ] }, { "required": [ - "pid" + "service_category_id" ] }, { "required": [ - "uid" + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" ] } ], "properties": { - "ancestry": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { "items": { - "$ref": "#/$defs/process_entity" + "type": "string" }, - "title": "Ancestry", + "title": "Labels", "type": "array" }, - "cmd_line": { - "title": "Command Line", + "load_order_group": { + "title": "Load Order Group", "type": "string" }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + "name": { + "title": "Name", + "type": "string" }, - "cpid": { - "title": "Common Process Identifier", + "service_category": { + "title": "Service Category", "type": "string" }, - "created_time": { - "title": "Created Time", + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", "type": "integer" }, - "environment_variables": { + "service_dependencies": { "items": { - "$ref": "#/$defs/environment_variable" + "type": "string" }, - "title": "Environment Variables", + "title": "Service Dependencies", "type": "array" }, - "file": { + "service_dll_file": { "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" + "title": "Service DLL" }, - "integrity": { - "title": "Integrity", + "service_error_control": { + "title": "Service Error Control", "type": "string" }, - "integrity_id": { + "service_error_control_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Integrity Level", + "title": "Service Error Control ID", "type": "integer" }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" + "service_start_name": { + "title": "Service Start Name", + "type": "string" }, - "name": { - "title": "Name", + "service_start_type": { + "title": "Service Start Type", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", "type": "integer" }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", + "service_type": { + "title": "Service Type", "type": "string" }, - "pid": { - "title": "Process ID", + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", "type": "integer" }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "sandbox": { - "title": "Sandbox", + "uid": { + "title": "Unique ID", "type": "string" }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Windows Service", + "type": "object" + }, + "group": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" }, - "tid": { - "title": "Thread ID", - "type": "integer" + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", + "uid_alt": { + "title": "Alternate ID", "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, - "title": "Process", + "title": "Group", "type": "object" }, - "process_entity": { + "device": { "additionalProperties": false, "anyOf": [ { "required": [ - "cmd_line" + "hostname" ] }, { "required": [ - "cpid" + "instance_uid" ] }, { "required": [ - "name" + "interface_name" ] }, { "required": [ - "path" + "interface_uid" ] }, { "required": [ - "pid" + "ip" + ] + }, + { + "required": [ + "name" ] }, { @@ -5799,222 +5951,157 @@ } ], "properties": { - "cmd_line": { - "title": "Command Line", + "region": { + "title": "Region", "type": "string" }, - "cpid": { - "title": "Common Process Identifier", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "path": { - "title": "Path", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "pid": { - "title": "Process ID", + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", + "desc": { + "title": "Description", "type": "string" }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", + "os_machine_uuid": { + "title": "OS Machine UUID", "type": "string" }, - "name": { - "title": "Name", + "hypervisor": { + "title": "Hypervisor", "type": "string" }, - "path": { - "title": "Path", + "type": { + "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "url_string": { - "title": "URL String", - "type": "string" + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" }, - "vendor_name": { - "title": "Vendor Name", + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", + "first_seen_time": { + "title": "First Seen", "type": "integer" }, - "type": { - "title": "Type", + "mac": { + "title": "MAC Address", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { + "imei_list": { "items": { - "$ref": "#/$defs/cis_control" + "type": "string" }, - "title": "CIS Controls", + "title": "IMEI List", "type": "array" }, - "desc": { - "title": "Description", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", "type": "string" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "image": { + "$ref": "#/$defs/image", + "title": "Image" }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] + "is_shared": { + "title": "Shared Device", + "type": "boolean" }, - { - "required": [ - "ip" - ] + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - { - "required": [ - "name" - ] + "meid": { + "title": "MEID", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", "type": "string" }, - "ip": { - "title": "IP Address", - "type": "string" + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" }, "name": { "title": "Name", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "uid": { - "title": "Unique ID", + "iccid": { + "title": "ICCID", "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" }, - "provider": { - "title": "Provider", + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "score": { - "title": "Reputation Score", + "udid": { + "title": "Unique Device Identifier", "type": "string" }, - "score_id": { + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, @@ -6027,65 +6114,91 @@ 8, 9, 10, + 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Reputation Score ID", + "title": "Type ID", "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" }, - "data": { - "title": "Data" + "last_seen_time": { + "title": "Last Seen", + "type": "integer" }, - "flags": { + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { "items": { - "type": "string" + "$ref": "#/$defs/network_interface" }, - "title": "Flags", + "title": "Network Interfaces", "type": "array" }, - "uid": { - "title": "Unique ID", + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "resource_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { "agent_list": { "items": { "$ref": "#/$defs/agent" @@ -6093,65 +6206,81 @@ "title": "Agent List", "type": "array" }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "criticality": { - "title": "Criticality", + "ip": { + "title": "IP Address", "type": "string" }, - "data": { - "title": "Data" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, "hostname": { "title": "Hostname", "type": "string" }, - "ip": { - "title": "IP Address", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", + "is_mobile_account_active": { + "title": "Mobile Account Active", "type": "boolean" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { "name": { "title": "Name", "type": "string" - }, - "namespace": { - "title": "Namespace", + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" + "src_url": { + "title": "Source URL", + "type": "string" }, - "role": { - "title": "Role", + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", "type": "string" }, - "role_id": { + "algorithm_id": { "enum": [ 0, 1, @@ -6160,77 +6289,108 @@ 4, 99 ], - "title": "Role ID", + "title": "Algorithm ID", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" }, - "type": { - "title": "Type", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "developer_uid": { + "title": "Developer UID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" }, - "version": { - "title": "Version", + "state": { + "title": "State", "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" } }, - "title": "Resource Details", + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", "type": "object" }, - "response": { + "sbom": { "additionalProperties": false, "properties": { - "code": { - "title": "Response Code", + "created_time": { + "title": "Created Time", "type": "integer" }, - "containers": { + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { "items": { - "$ref": "#/$defs/container" + "$ref": "#/$defs/software_component" }, - "title": "Containers", + "title": "Software Components", "type": "array" }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", + "type": { + "title": "Type", "type": "string" }, - "error_message": { - "title": "Error Message", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" + "uid": { + "title": "SBOM ID", + "type": "string" }, - "message": { - "title": "Message", + "version": { + "title": "Version", "type": "string" } }, - "title": "Response Elements", + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", "type": "object" }, - "rule": { + "malware_scan_info": { "additionalProperties": false, "anyOf": [ { @@ -6245,114 +6405,140 @@ } ], "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" + "end_time": { + "title": "End Time", + "type": "integer" }, "name": { "title": "Name", "type": "string" }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + "uid": { + "title": "Scan UID", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" } }, "required": [ - "name", - "type" + "type_id" ], - "title": "Subject Alternative Name", + "title": "Malware Scan Info", "type": "object" }, - "sbom": { + "kill_chain_phase": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "package": { - "$ref": "#/$defs/package", - "title": "Software Package" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "software_components": { - "items": { - "$ref": "#/$defs/software_component" - }, - "title": "Software Components", - "type": "array" - }, - "type": { - "title": "Type", + "phase": { + "title": "Kill Chain Phase", "type": "string" }, - "type_id": { + "phase_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Type ID", + "title": "Kill Chain Phase ID", "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" }, - "uid": { - "title": "SBOM ID", + "ou_name": { + "title": "Org Unit Name", "type": "string" }, - "version": { - "title": "Version", + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "package", - "software_components" - ], - "title": "Software Bill of Materials", + "title": "Organization", "type": "object" }, - "scim": { + "encryption_details": { "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "algorithm": { + "title": "Encryption Algorithm", "type": "string" }, - "auth_protocol_id": { + "algorithm_id": { "enum": [ 0, 1, @@ -6361,127 +6547,234 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", + "title": "Encryption Algorithm ID", "type": "integer" }, - "created_time": { - "title": "Created Time", + "key_length": { + "title": "Encryption Key Length", "type": "integer" }, - "error_message": { - "title": "Last Error Message", + "key_uid": { + "title": "Key UID", "type": "string" }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" + "event_uid": { + "title": "Event UID", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "name": { - "title": "Name", + "log_format": { + "title": "Log Format", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "log_level": { + "title": "Log Level", "type": "string" }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" + "log_name": { + "title": "Log Name", + "type": "string" }, - "scim_group_schema": { - "title": "SCIM Group Schema" + "log_provider": { + "title": "Log Provider", + "type": "string" }, - "scim_user_schema": { - "title": "SCIM User Schema" + "log_version": { + "title": "Log Version", + "type": "string" }, - "state": { - "title": "State", + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", "type": "string" }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "External ID", + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "url_string": { - "title": "SCIM Endpoint URL", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Service Provider", + "uid": { + "title": "Unique ID", "type": "string" }, "version": { - "title": "SCIM Version", + "title": "Version", "type": "string" } }, - "title": "SCIM", + "title": "Feature", "type": "object" }, - "script": { + "timespan": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "duration_years": { + "title": "Duration Years", + "type": "integer" }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" + "end_time": { + "title": "End Time", + "type": "integer" }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" + "start_time": { + "title": "Start Time", + "type": "integer" }, "type": { - "title": "Type", + "title": "Time Span Type", "type": "string" }, "type_id": { @@ -6494,24 +6787,18 @@ 5, 6, 7, + 8, + 9, 99 ], - "title": "Type ID", + "title": "Time Span Type ID", "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" } }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", + "title": "Time Span", "type": "object" }, - "service": { + "rule": { "additionalProperties": false, "anyOf": [ { @@ -6526,93 +6813,32 @@ } ], "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", + "category": { + "title": "Category", "type": "string" }, - "expiration_reason": { - "title": "Expiration Reason", + "desc": { + "title": "Description", "type": "string" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", + "name": { + "title": "Name", "type": "string" }, - "terminal": { - "title": "Terminal", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", + "version": { + "title": "Version", "type": "string" } }, - "title": "Session", + "title": "Rule", "type": "object" }, "software_component": { @@ -6682,151 +6908,170 @@ "title": "Software Component", "type": "object" }, - "span": { + "agent": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "name": { + "title": "Agent Name", + "type": "string" }, - "end_time": { - "title": "End Time", - "type": "integer" + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" }, - "message": { - "title": "Message", + "type": { + "title": "Agent Type", "type": "string" }, - "operation": { - "title": "Operation", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "parent_uid": { - "title": "Parent Unique ID", + "uid": { + "title": "Agent ID", "type": "string" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" }, - "status_code": { - "title": "Status Code", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "uid": { - "title": "Unique ID", + "version": { + "title": "Agent Version", "type": "string" } }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", + "title": "Agent", "type": "object" }, - "sso": { + "whois": { "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", "type": "string" }, - "auth_protocol_id": { + "dnssec_status_id": { "enum": [ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", + "title": "DNSSEC Status ID", "type": "integer" }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" + "domain": { + "title": "Domain", + "type": "string" }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" }, - "login_endpoint": { - "title": "SSO Login Endpoint", + "email_addr": { + "title": "Registrar Abuse Email Address", "type": "string" }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", + "isp": { + "title": "ISP Name", "type": "string" }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "modified_time": { - "title": "Modified Time", + "last_seen_time": { + "title": "Last Updated At", "type": "integer" }, - "name": { - "title": "Name", + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "registrar": { + "title": "Domain Registrar", "type": "string" }, - "scopes": { + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { "items": { "type": "string" }, - "title": "Scopes", + "title": "Subdomains", "type": "array" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", + "subnet": { + "title": "Subnet Block", "type": "string" } }, - "title": "SSO", + "title": "WHOIS", "type": "object" }, - "sub_technique": { + "key_value_object": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "value" ] }, { "required": [ - "uid" + "values" ] } ], @@ -6835,536 +7080,401 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "value": { + "title": "Value", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" } }, - "title": "MITRE Sub-technique", + "required": [ + "name" + ], + "title": "Key:Value object", "type": "object" }, - "tactic": { + "metadata": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "log_format": { + "title": "Log Source Format", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" }, "uid": { - "title": "Unique ID", + "title": "Event UID", "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", + "original_event_uid": { + "title": "Original Event ID", "type": "string" }, - "src_url": { - "title": "Source URL", + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", "type": "string" }, - "uid": { - "title": "Unique ID", + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "MITRE Technique", + "required": [ + "product", + "version" + ], + "title": "Metadata", "type": "object" }, - "threat_actor": { + "node": { "additionalProperties": false, "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, "type": { - "title": "Threat Actor Type", + "title": "Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" + "uid": { + "title": "Unique ID", + "type": "string" } }, "required": [ - "name" + "uid" ], - "title": "Threat Actor", + "title": "Node", "type": "object" }, - "timespan": { + "product": { "additionalProperties": false, "anyOf": [ { "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" + "name" ] }, { "required": [ - "start_time" + "uid" ] } ], "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" }, - "duration_months": { - "title": "Duration Months", - "type": "integer" + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" + "lang": { + "title": "Language", + "type": "string" }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "duration_years": { - "title": "Duration Years", - "type": "integer" + "path": { + "title": "Path", + "type": "string" }, - "end_time": { - "title": "End Time", - "type": "integer" + "uid": { + "title": "Unique ID", + "type": "string" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "url_string": { + "title": "URL String", + "type": "string" }, - "type": { - "title": "Time Span Type", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" + "version": { + "title": "Version", + "type": "string" } }, - "title": "Time Span", + "title": "Product", "type": "object" }, - "token": { + "advisory": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "bulletin": { + "title": "Patch Bulletin", + "type": "string" }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" + "classification": { + "title": "Classification", + "type": "string" }, - "modified_time": { - "title": "Modified Time", + "created_time": { + "title": "Created Time", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", + "desc": { + "title": "Description", "type": "string" }, - "type": { - "title": "Type", + "install_state": { + "title": "Install State", "type": "string" }, - "type_id": { + "install_state_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, - 6, - 7, 99 ], - "title": "Type ID", + "title": "Install State ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "end_time": { - "title": "End Time", - "type": "integer" + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" }, - "flags": { + "related_cwes": { "items": { - "type": "string" + "$ref": "#/$defs/cwe" }, - "title": "Flags", + "title": "Related CWEs", "type": "array" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "size": { + "title": "Size", + "type": "integer" }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" + "src_url": { + "title": "Source URL", + "type": "string" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "title": { + "title": "Title", + "type": "string" }, "uid": { - "title": "Unique ID", + "title": "Advisory ID", "type": "string" } }, "required": [ "uid" ], - "title": "Trace", + "title": "Advisory", "type": "object" }, - "transformation_info": { + "network_endpoint": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "domain" ] }, { "required": [ - "uid" + "hostname" ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ { "required": [ - "path" + "instance_uid" ] }, { "required": [ - "url_string" + "interface_name" ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" + { + "required": [ + "interface_uid" + ] }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ { "required": [ - "account" + "ip" ] }, { @@ -7372,6 +7482,11 @@ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -7379,90 +7494,86 @@ } ], "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "display_name": { - "title": "Display Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "domain": { - "title": "Domain", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "email_addr": { - "title": "Email Address", + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "forward_addr": { - "title": "Forwarding Address", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "full_name": { - "title": "Full Name", + "mac": { + "title": "MAC Address", "type": "string" }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "name": { - "title": "Name", + "isp": { + "title": "ISP Name", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "zone": { + "title": "Network Zone", + "type": "string" }, - "phone_number": { - "title": "Telephone Number", + "name": { + "title": "Name", "type": "string" }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "risk_level": { - "title": "Risk Level", - "type": "string" + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" }, - "risk_level_id": { + "network_scope_id": { "enum": [ 0, 1, 2, - 3, - 4, 99 ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", + "title": "Network Scope ID", "type": "integer" }, - "type": { - "title": "Type", + "svc_name": { + "title": "Service Name", "type": "string" }, "type_id": { @@ -7472,170 +7583,163 @@ 2, 3, 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, 99 ], "title": "Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", + "network_scope": { + "title": "Network Scope", "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "affected_code": { + "intermediate_ips": { "items": { - "$ref": "#/$defs/affected_code" + "type": "string" }, - "title": "Affected Code", + "title": "Intermediate IP Addresses", "type": "array" }, - "affected_packages": { + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { "items": { - "$ref": "#/$defs/affected_package" + "$ref": "#/$defs/fingerprint" }, - "title": "Affected Software Packages", + "title": "Fingerprints", "type": "array" }, - "category": { - "title": "Category", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" + "domain": { + "title": "Domain", + "type": "string" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "dependency_chain": { - "title": "Dependency Chain", + "ip": { + "title": "IP Address", "type": "string" }, - "desc": { - "title": "Description", + "hostname": { + "title": "Hostname", "type": "string" }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" }, - "exploit_type": { - "title": "Exploit Type", + "mac_vendor": { + "title": "MAC Vendor", "type": "string" + } + }, + "title": "Network Endpoint", + "type": "object" + }, + "d3f_tactic": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" }, - "fix_coverage": { - "title": "Fix Coverage", + "src_url": { + "title": "Source URL", "type": "string" }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", "type": "integer" }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { + "cvss": { "items": { - "$ref": "#/$defs/kb_article" + "$ref": "#/$defs/cvss" }, - "title": "Knowledgebase Articles", + "title": "CVSS Score", "type": "array" }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" }, - "last_seen_time": { - "title": "Last Seen", + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, "references": { "items": { @@ -7644,284 +7748,180 @@ "title": "References", "type": "array" }, - "related_vulnerabilities": { + "related_cwes": { "items": { - "type": "string" + "$ref": "#/$defs/cwe" }, - "title": "Related Vulnerability IDs", + "title": "Related CWEs", "type": "array" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, "title": { "title": "Title", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", "type": "string" } }, - "title": "Vulnerability Details", + "required": [ + "uid" + ], + "title": "CVE", "type": "object" }, - "whois": { + "domain_contact": { "additionalProperties": false, "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, "email_addr": { - "title": "Registrar Abuse Email Address", + "title": "Contact Email", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" }, - "isp_org": { - "title": "ISP Org", + "name": { + "title": "Name", "type": "string" }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", + "title": "Phone Number", "type": "string" }, - "status": { - "title": "Domain Status", + "type": { + "title": "Domain Contact Type", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" }, - "subnet": { - "title": "Subnet Block", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "WHOIS", + "required": [ + "type_id" + ], + "title": "Domain Contact", "type": "object" }, - "win_win_service": { + "policy": { "additionalProperties": false, "anyOf": [ { "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" + "name" ] }, { "required": [ - "service_start_type_id" + "type" ] }, { "required": [ - "service_type_id" + "uid" ] } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" + "data": { + "title": "Data" }, - "name": { - "title": "Name", + "desc": { + "title": "Description", "type": "string" }, - "service_category": { - "title": "Service Category", - "type": "string" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" + "is_applied": { + "title": "Applied", + "type": "boolean" }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" + "type": { + "title": "Type", + "type": "string" }, - "service_error_control": { - "title": "Service Error Control", + "uid": { + "title": "Unique ID", "type": "string" }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" + "end_time": { + "title": "End Time", + "type": "integer" }, - "service_start_name": { - "title": "Service Start Name", + "message": { + "title": "Message", "type": "string" }, - "service_start_type": { - "title": "Service Start Type", + "operation": { + "title": "Operation", "type": "string" }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "status_code": { + "title": "Status Code", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "name" + "end_time", + "start_time", + "uid" ], - "title": "Windows Service", + "title": "Span", "type": "object" } }, @@ -7929,159 +7929,176 @@ "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { - "action": { - "title": "Action", + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", "type": "string" }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Activity ID", + "disposition": { + "title": "Disposition", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", "type": "integer" }, - "activity_name": { - "title": "Activity", + "action": { + "title": "Action", "type": "string" }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "ai_model": { - "$ref": "#/$defs/ai_model", - "title": "AI Model" + "confidence": { + "title": "Confidence", + "type": "string" }, "api": { "$ref": "#/$defs/api", "title": "API Details" }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" }, - "category_name": { - "title": "Category", + "risk_details": { + "title": "Risk Details", "type": "string" }, - "category_uid": { - "const": 6, - "title": "Category ID", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "class_name": { - "title": "Class", + "status_detail": { + "title": "Status Detail", "type": "string" }, - "class_uid": { - "const": 6003, - "title": "Class ID", + "confidence_score": { + "title": "Confidence Score", "type": "integer" }, - "confidence": { - "title": "Confidence", + "status_code": { + "title": "Status Code", "type": "string" }, - "confidence_id": { + "disposition_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, 99 ], - "title": "Confidence ID", + "title": "Disposition ID", "type": "integer" }, - "confidence_score": { - "title": "Confidence Score", + "type_name": { + "title": "Type Name", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", "type": "integer" }, - "count": { - "title": "Count", + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", "type": "integer" }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" }, - "disposition": { - "title": "Disposition", + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "status": { + "title": "Status", "type": "string" }, - "disposition_id": { + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "activity_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, 99 ], - "title": "Disposition ID", + "title": "Activity ID", "type": "integer" }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "duration": { - "title": "Duration Milliseconds", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "end_time": { - "title": "End Time", - "type": "integer" + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" }, "enrichments": { "items": { @@ -8090,170 +8107,153 @@ "title": "Enrichments", "type": "array" }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, "http_request": { "$ref": "#/$defs/http_request", "title": "HTTP Request" }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" - }, - "is_alert": { - "title": "Alert", - "type": "boolean" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "message_context": { - "$ref": "#/$defs/message_context", - "title": "Message Context" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "observables": { + "authorizations": { "items": { - "$ref": "#/$defs/observable" + "$ref": "#/$defs/authorization" }, - "title": "Observables", + "title": "Authorization Information", "type": "array" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, "raw_data_hash": { "$ref": "#/$defs/fingerprint", "title": "Raw Data Hash" }, - "raw_data_size": { - "title": "Raw Data Size", + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", "type": "integer" }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Resources Array", - "type": "array" - }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { + "confidence_id": { "enum": [ 0, 1, 2, 3, - 4, 99 ], - "title": "Risk Level ID", + "title": "Confidence ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", "type": "integer" }, - "severity": { - "title": "Severity", + "activity_name": { + "title": "Activity", "type": "string" }, - "severity_id": { + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Severity ID", + "title": "Risk Level ID", "type": "integer" }, - "src_endpoint": { + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "dst_endpoint": { "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" + "title": "Destination Endpoint" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "is_alert": { + "title": "Alert", + "type": "boolean" }, - "status": { - "title": "Status", - "type": "string" + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "status_code": { - "title": "Status Code", + "severity": { + "title": "Severity", "type": "string" }, - "status_detail": { - "title": "Status Detail", + "category_name": { + "title": "Category", "type": "string" }, - "status_id": { + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "severity_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Status ID", + "title": "Severity ID", "type": "integer" }, - "time": { - "title": "Event Time", + "count": { + "title": "Count", "type": "integer" }, - "timezone_offset": { - "title": "Timezone Offset", + "end_time": { + "title": "End Time", "type": "integer" }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, "type_uid": { "title": "Type ID", "type": "integer" }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" } }, "required": [ diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json index af3391c00d..a0a313d187 100644 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+container+host+trace.json @@ -1,11 +1,11 @@ { "$defs": { - "account": { + "kb_article": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "src_url" ] }, { @@ -14,152 +14,6 @@ ] } ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, "properties": { "avg_timespan": { "$ref": "#/$defs/timespan", @@ -177,10 +31,6 @@ "title": "Created Time", "type": "integer" }, - "desc": { - "title": "Description", - "type": "string" - }, "install_state": { "title": "Install State", "type": "string" @@ -200,10 +50,6 @@ "title": "The patch is superseded.", "type": "boolean" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "os": { "$ref": "#/$defs/os", "title": "OS" @@ -212,26 +58,9 @@ "$ref": "#/$defs/product", "title": "Product" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, "size": { "title": "Size", @@ -246,247 +75,238 @@ "type": "string" }, "uid": { - "title": "Advisory ID", + "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Advisory", + "title": "KB Article", "type": "object" }, - "affected_code": { + "long_string": { "additionalProperties": false, "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "start_column": { - "title": "Start Column", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "file" + "value" ], - "title": "Affected Code", + "title": "Long String", "type": "object" }, - "affected_package": { + "enrichment": { "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpe_name": { - "title": "The product CPE identifier", + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "fixed_in_version": { - "title": "Fixed In Version", + "provider": { + "title": "Provider", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "license": { - "title": "Software License", + "short_desc": { + "title": "Short Description", "type": "string" }, - "license_url": { - "title": "Software License URL", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "type": { + "title": "Type", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", "type": "string" }, - "path": { - "title": "Path", + "display_name": { + "title": "Display Name", "type": "string" }, - "purl": { - "title": "Package URL", + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", "type": "string" }, - "release": { - "title": "Software Release Details", + "given_name": { + "title": "Given Name", "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "hire_time": { + "title": "Hire Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "job_title": { + "title": "Job Title", "type": "string" }, - "type": { - "title": "Type", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", "type": "integer" }, - "uid": { - "title": "Package UID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "version": { - "title": "Version", + "surname": { + "title": "Surname", "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" } }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", + "title": "LDAP Person", "type": "object" }, - "agent": { + "email_auth": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Agent Name", + "dkim": { + "title": "DKIM Status", "type": "string" }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", + "dkim_domain": { + "title": "DKIM Domain", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" }, - "uid": { - "title": "Agent ID", + "dmarc": { + "title": "DMARC Status", "type": "string" }, - "uid_alt": { - "title": "Alternate Agent ID", + "dmarc_override": { + "title": "DMARC Override", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "dmarc_policy": { + "title": "DMARC Policy", "type": "string" }, - "version": { - "title": "Agent Version", + "spf": { + "title": "SPF Status", "type": "string" } }, - "title": "Agent", + "title": "Email Authentication", "type": "object" }, - "ai_model": { + "epss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "ai_provider": { - "title": "AI Provider", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "percentile": { + "title": "EPSS Percentile", + "type": "number" }, - "uid": { - "title": "Unique ID", + "score": { + "title": "EPPS Score", "type": "string" }, "version": { @@ -495,54 +315,35 @@ } }, "required": [ - "ai_provider" + "score" ], - "title": "AI Model", + "title": "EPSS", "type": "object" }, - "analytic": { + "device_hw_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", + "bios_manufacturer": { + "title": "BIOS Manufacturer", "type": "string" }, - "desc": { - "title": "Description", + "bios_ver": { + "title": "BIOS Version", "type": "string" }, - "name": { - "title": "Name", + "chassis": { + "title": "Chassis", "type": "string" }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", + "cpu_architecture": { + "title": "CPU Architecture", "type": "string" }, - "state_id": { + "cpu_architecture_id": { "enum": [ 0, 1, @@ -550,93 +351,111 @@ 3, 99 ], - "title": "State ID", + "title": "CPU Architecture ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", + "cpu_cores": { + "title": "CPU Cores", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "cpu_count": { + "title": "CPU Count", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" }, - "operation": { - "title": "Operation", + "cpu_type": { + "title": "Processor Type", "type": "string" }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" + "gpu_count": { + "title": "GPU Count", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" }, - "version": { - "title": "Version", + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "required": [ - "operation" - ], - "title": "API", + "title": "Device Hardware Info", "type": "object" }, - "application": { + "network_proxy": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -644,166 +463,89 @@ } ], "properties": { - "criticality": { - "title": "Business Criticality", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Application Description", + "uid": { + "title": "Unique ID", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "hostname": { - "title": "Hostname", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "name": { - "title": "Application Name", + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Application Relationship" + "instance_uid": { + "title": "Instance ID", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "mac": { + "title": "MAC Address", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "sbom": { - "$ref": "#/$defs/sbom", - "title": "Related SBOM" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Application Type", - "type": "string" - }, - "uid": { - "title": "Application ID", + "isp": { + "title": "ISP Name", "type": "string" }, - "uid_alt": { - "title": "Application Alternative ID", + "zone": { + "title": "Network Zone", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Application Version", + "name": { + "title": "Name", "type": "string" - } - }, - "title": "Application", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" }, - "email_addr": { - "title": "Email Address", - "type": "string" + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - "factor_type": { - "title": "Factor Type", + "svc_name": { + "title": "Service Name", "type": "string" }, - "factor_type_id": { + "type_id": { "enum": [ 0, 1, @@ -817,107 +559,37 @@ 9, 10, 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Factor Type ID", + "title": "Type ID", "type": "integer" }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", + "network_scope": { + "title": "Network Scope", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "security_questions": { + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { "items": { "type": "string" }, - "title": "Security Questions", + "title": "Intermediate IP Addresses", "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + "isp_org": { + "title": "ISP Org", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" }, "fingerprints": { "items": { @@ -926,128 +598,199 @@ "title": "Fingerprints", "type": "array" }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" + "vpc_uid": { + "title": "VPC UID", + "type": "string" }, - "issuer": { - "title": "Issuer Distinguished Name", + "domain": { + "title": "Domain", "type": "string" }, - "sans": { + "agent_list": { "items": { - "$ref": "#/$defs/san" + "$ref": "#/$defs/agent" }, - "title": "Subject Alternative Names", + "title": "Agent List", "type": "array" }, - "serial_number": { - "title": "Certificate Serial Number", + "ip": { + "title": "IP Address", "type": "string" }, - "subject": { - "title": "Subject Distinguished Name", + "hostname": { + "title": "Hostname", "type": "string" }, - "uid": { - "title": "Unique ID", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "version": { - "title": "Version", + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", + "title": "Network Proxy Endpoint", "type": "object" }, - "cis_control": { + "data_classification": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], "properties": { - "desc": { - "title": "Description", + "category": { + "title": "Category", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" }, - "version": { - "title": "Version", + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", + "status": { + "title": "Status", "type": "string" }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "required": [ - "type" - ], - "title": "Classifier Details", + "title": "Data Classification", "type": "object" }, - "cloud": { + "http_response": { "additionalProperties": false, "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" + "body_length": { + "title": "Response Body Length", + "type": "integer" }, - "cloud_partition": { - "title": "Cloud Partition", + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "project_uid": { - "title": "Project ID", - "type": "string" + "latency": { + "title": "Latency", + "type": "integer" }, - "provider": { - "title": "Cloud Provider", - "type": "string" + "length": { + "title": "Response Length", + "type": "integer" }, - "region": { - "title": "Region", + "message": { + "title": "Message", "type": "string" }, - "zone": { - "title": "Cloud Availability Zone", + "status": { + "title": "Status", "type": "string" } }, "required": [ - "provider" + "code" ], - "title": "Cloud", + "title": "HTTP Response", "type": "object" }, - "container": { + "resource_details": { "additionalProperties": false, "anyOf": [ { @@ -1062,13 +805,39 @@ } ], "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" }, "labels": { "items": { @@ -1077,34 +846,42 @@ "title": "Labels", "type": "array" }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "network_driver": { - "title": "Network Driver", + "namespace": { + "title": "Namespace", "type": "string" }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" }, - "runtime": { - "title": "Runtime", + "role": { + "title": "Role", "type": "string" }, - "size": { - "title": "Size", + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", "type": "integer" }, - "tag": { - "title": "Image Tag", - "type": "string" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -1112,279 +889,384 @@ "title": "Tags", "type": "array" }, + "type": { + "title": "Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" - } - }, - "title": "Container", + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", "type": "object" }, - "cve": { + "display": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "color_depth": { + "title": "Color Depth", "type": "integer" }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" + "physical_height": { + "title": "Physical Height", + "type": "integer" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" + "physical_width": { + "title": "Physical Width", + "type": "integer" }, - "cwe_url": { - "title": "CWE URL", + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "desc": { - "title": "Description", + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", "type": "string" }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "name": { + "title": "Name", + "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "protocol_name": { + "title": "Supported Protocol", + "type": "string" }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "rate_limit": { + "title": "Rate Limit", + "type": "integer" }, - "title": { - "title": "Title", - "type": "string" + "scim_group_schema": { + "title": "SCIM Group Schema" }, - "type": { - "title": "Vulnerability Type", - "type": "string" + "scim_user_schema": { + "title": "SCIM User Schema" }, - "uid": { - "title": "CVE ID", + "state": { + "title": "State", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" }, - "depth": { + "state_id": { "enum": [ - "Base", - "Environmental", - "Temporal" + 0, + 1, + 2, + 3, + 4, + 99 ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" + "title": "State ID", + "type": "integer" }, - "severity": { - "title": "Severity", + "uid": { + "title": "Unique ID", "type": "string" }, - "src_url": { - "title": "Source URL", + "uid_alt": { + "title": "External ID", "type": "string" }, - "vector_string": { - "title": "Vector String", + "url_string": { + "title": "SCIM Endpoint URL", "type": "string" }, "vendor_name": { - "title": "Vendor Name", + "title": "Service Provider", "type": "string" }, "version": { - "title": "Version", + "title": "SCIM Version", "type": "string" } }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", + "title": "SCIM", "type": "object" }, - "cwe": { + "programmatic_credential": { "additionalProperties": false, "properties": { - "caption": { - "title": "Caption", - "type": "string" + "last_used_time": { + "title": "Last Used Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "type": { + "title": "Type", "type": "string" }, "uid": { - "title": "CWE ID", + "title": "Unique ID", "type": "string" } }, "required": [ "uid" ], - "title": "CWE", + "title": "Programmatic Credential", "type": "object" }, - "d3f_tactic": { + "os": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "build": { + "title": "OS Build", "type": "string" }, - "src_url": { - "title": "Source URL", + "country": { + "title": "Country", "type": "string" }, - "uid": { - "title": "Unique ID", + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "sp_name": { + "title": "OS Service Pack", "type": "string" }, - "uid": { - "title": "Unique ID", + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "MITRE D3FEND\u2122 Technique", + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", "type": "object" }, - "d3fend": { + "tactic": { "additionalProperties": false, "anyOf": [ { "required": [ - "d3f_tactic" + "name" ] }, { "required": [ - "d3f_technique" + "uid" ] } ], "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" + "name": { + "title": "Name", + "type": "string" }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" + "src_url": { + "title": "Source URL", + "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "MITRE D3FEND\u2122", + "title": "MITRE Tactic", "type": "object" }, - "data_classification": { + "dns_answer": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" }, - { - "required": [ - "confidentiality_id" - ] + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" } + }, + "required": [ + "rdata" ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, "properties": { - "category": { - "title": "Category", + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", "type": "string" }, - "category_id": { + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { "enum": [ 0, 1, @@ -1393,114 +1275,247 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, 99 ], - "title": "Category ID", + "title": "Auth Protocol ID", "type": "integer" }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "duration_mins": { + "title": "SSO Session Duration", "type": "integer" }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" }, - "size": { - "title": "Size", + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "src_url": { - "title": "Source URL", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "status_details": { + "scopes": { "items": { "type": "string" }, - "title": "Status Details", + "title": "Scopes", "type": "array" }, - "status_id": { - "enum": [ - 0, - 1, - 2, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Data Classification", + "title": "Token", "type": "object" }, - "device": { + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "d3f_tactic" ] }, { "required": [ - "instance_uid" + "d3f_technique" ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" }, - { - "required": [ - "interface_name" - ] + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" }, - { - "required": [ - "interface_uid" - ] + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" }, - { - "required": [ - "ip" - ] + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ { "required": [ "name" @@ -1513,207 +1528,192 @@ } ], "properties": { - "agent_list": { + "countermeasures": { "items": { - "$ref": "#/$defs/agent" + "$ref": "#/$defs/d3fend" }, - "title": "Agent List", + "title": "Countermeasures", "type": "array" }, - "autoscale_uid": { - "title": "Autoscale UID", + "name": { + "title": "Name", "type": "string" }, - "boot_time": { - "title": "Boot Time", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "boot_uid": { - "title": "Boot UID", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + { + "required": [ + "country" + ] }, - "created_time": { - "title": "Created Time", - "type": "integer" + { + "required": [ + "postal_code" + ] }, - "desc": { - "title": "Description", + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", "type": "string" }, - "domain": { - "title": "Domain", + "city": { + "title": "City", "type": "string" }, - "eid": { - "title": "EID", + "continent": { + "title": "Continent", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { + "coordinates": { "items": { - "$ref": "#/$defs/group" + "type": "number" }, - "title": "Groups", + "title": "Coordinates", "type": "array" }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", + "country": { + "title": "Country", "type": "string" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", + "desc": { + "title": "Description", "type": "string" }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", + "geodetic_altitude": { + "title": "Geodetic Altitude", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "geohash": { + "title": "Geohash", "type": "string" }, - "ip": { - "title": "IP Address", + "horizontal_accuracy": { + "title": "Horizontal Accuracy", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", + "is_on_premises": { + "title": "On-Premises", "type": "boolean" }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "isp": { + "title": "ISP Name", + "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + "lat": { + "title": "Latitude", + "type": "number" }, - "mac": { - "title": "MAC Address", - "type": "string" + "long": { + "title": "Longitude", + "type": "number" }, - "mac_vendor": { - "title": "MAC Vendor", + "postal_code": { + "title": "Postal Code", "type": "string" }, - "meid": { - "title": "MEID", + "pressure_altitude": { + "title": "Pressure Altitude", "type": "string" }, - "model": { - "title": "Model", + "provider": { + "title": "Provider", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", + "region": { + "title": "Region", "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { "items": { - "$ref": "#/$defs/network_interface" + "$ref": "#/$defs/auth_factor" }, - "title": "Network Interfaces", + "title": "Authentication Factors", "type": "array" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "domain": { + "title": "Domain", + "type": "string" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "issuer": { + "title": "Issuer Details", + "type": "string" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "name": { + "title": "Name", + "type": "string" }, - "region": { - "title": "Region", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "risk_level": { - "title": "Risk Level", + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", "type": "string" }, - "risk_level_id": { + "state_id": { "enum": [ 0, 1, @@ -1722,26 +1722,45 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "subnet": { - "title": "Subnet", + "uid": { + "title": "Unique ID", "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "url_string": { + "title": "Configuration URL", "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] }, - "type": { - "title": "Type", + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", "type": "string" }, - "type_id": { + "ai_role_id": { "enum": [ 0, 1, @@ -1750,636 +1769,550 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "AI Role ID", "type": "integer" }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" + "application": { + "$ref": "#/$defs/application", + "title": "Application" }, - "uid": { - "title": "Unique ID", - "type": "string" + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" }, - "uid_alt": { - "title": "Alternate ID", + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "total_tokens": { + "title": "Total Tokens", + "type": "integer" }, - "zone": { - "title": "Network Zone", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Device", + "title": "Message Context", "type": "object" }, - "device_hw_info": { + "process": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "chassis": { - "title": "Chassis", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "cpu_architecture": { - "title": "CPU Architecture", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", "type": "string" }, - "cpu_architecture_id": { + "integrity_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, 99 ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", + "title": "Integrity Level", "type": "integer" }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" }, - "cpu_type": { - "title": "Processor Type", + "name": { + "title": "Name", "type": "string" }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" + "path": { + "title": "Path", + "type": "string" }, - "ram_size": { - "title": "RAM Size", + "pid": { + "title": "Process ID", "type": "integer" }, - "serial_number": { - "title": "Serial Number", - "type": "string" + "ptid": { + "title": "Process Thread ID", + "type": "integer" }, - "uuid": { - "title": "UUID", + "sandbox": { + "title": "Sandbox", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", + "terminated_time": { + "title": "Terminated Time", "type": "integer" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", + "tid": { + "title": "Thread ID", "type": "integer" }, - "developer_uid": { - "title": "Developer UID", + "uid": { + "title": "Unique ID", "type": "string" }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" + "user": { + "$ref": "#/$defs/user", + "title": "User" }, - "state": { - "title": "State", + "working_directory": { + "title": "Working Directory", "type": "string" }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" } }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", + "title": "Process", "type": "object" }, - "discovery_details": { + "vulnerability": { "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" + "required": [ + "advisory" + ] }, - "physical_width": { - "title": "Physical Width", - "type": "integer" + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, + ], "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" }, - "flag_ids": { + "affected_code": { "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" + "$ref": "#/$defs/affected_code" }, - "title": "DNS Header Flags", + "title": "Affected Code", "type": "array" }, - "flags": { + "affected_packages": { "items": { - "type": "string" + "$ref": "#/$defs/affected_package" }, - "title": "DNS Header Flags", + "title": "Affected Software Packages", "type": "array" }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", + "category": { + "title": "Category", "type": "string" }, - "ttl": { - "title": "TTL", - "type": "integer" + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" }, - "type": { - "title": "Resource Record Type", + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", + }, + "desc": { + "title": "Description", "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" }, - "name": { - "title": "Name", + "exploit_ref_url": { + "title": "Exploit URL", "type": "string" }, - "phone_number": { - "title": "Phone Number", + "exploit_requirement": { + "title": "Exploit Requirement", "type": "string" }, - "type": { - "title": "Domain Contact Type", + "exploit_type": { + "title": "Exploit Type", "type": "string" }, - "type_id": { + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, 99 ], - "title": "Domain Contact Type ID", + "title": "Fix Coverage ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "edge": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" }, - "is_directed": { - "title": "Directed", + "is_fix_available": { + "title": "Fix Availability", "type": "boolean" }, - "name": { - "title": "Name", - "type": "string" + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" }, - "relation": { - "title": "Relation", - "type": "string" + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" }, - "source": { - "title": "Source", - "type": "string" + "last_seen_time": { + "title": "Last Seen", + "type": "integer" }, - "target": { - "title": "Target", - "type": "string" + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "source", - "target" - ], - "title": "Edge", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { + "references": { "items": { "type": "string" }, - "title": "Cc", + "title": "References", "type": "array" }, - "cc_mailboxes": { + "related_vulnerabilities": { "items": { "type": "string" }, - "title": "Cc Mailboxes", + "title": "Related Vulnerability IDs", "type": "array" }, - "delivered_to": { - "title": "Delivered To", - "type": "string" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" + "title": { + "title": "Title", + "type": "string" }, - "from": { - "title": "From", + "vendor_name": { + "title": "Vendor Name", "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" + "end_line": { + "title": "End Line", + "type": "integer" }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "is_read": { - "title": "Read", - "type": "boolean" + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" }, - "message_uid": { - "title": "Message UID", + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", "type": "string" }, - "raw_header": { - "title": "Raw Header", + "keyboard_layout": { + "title": "Keyboard Layout", "type": "string" }, - "reply_to": { - "title": "Reply To", + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" }, - "reply_to_list": { + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { "items": { - "type": "string" + "$ref": "#/$defs/fingerprint" }, - "title": "Reply To List", + "title": "Fingerprints", "type": "array" }, - "reply_to_mailboxes": { + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { "items": { - "type": "string" + "$ref": "#/$defs/san" }, - "title": "Reply To Mailboxes", + "title": "Subject Alternative Names", "type": "array" }, - "return_path": { - "title": "Return Path", + "serial_number": { + "title": "Certificate Serial Number", "type": "string" }, - "sender": { - "title": "Sender", + "subject": { + "title": "Subject Distinguished Name", "type": "string" }, - "sender_mailbox": { - "title": "Sender Mailbox", + "uid": { + "title": "Unique ID", "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "smtp_from": { - "title": "SMTP From", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", "type": "string" }, - "smtp_to": { + "edges": { "items": { - "type": "string" + "$ref": "#/$defs/edge" }, - "title": "SMTP To", + "title": "Edges", "type": "array" }, - "subject": { - "title": "Subject", - "type": "string" + "is_directed": { + "title": "Directed", + "type": "boolean" }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "to_mailboxes": { + "nodes": { "items": { - "type": "string" + "$ref": "#/$defs/node" }, - "title": "To Mailboxes", + "title": "Nodes", "type": "array" }, - "uid": { - "title": "Email Thread UID", + "query_language": { + "title": "Query Language", "type": "string" }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { + "query_language_id": { "enum": [ 0, 1, @@ -2388,124 +2321,127 @@ 4, 5, 6, + 7, 99 ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", + "title": "Query Language ID", "type": "integer" }, - "key_uid": { - "title": "Key UID", + "type": { + "title": "Type", "type": "string" }, - "type": { - "title": "Encryption Type", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Encryption Details", + "required": [ + "nodes" + ], + "title": "Graph", "type": "object" }, - "enrichment": { + "account": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" + "is_disabled": { + "title": "Disabled", + "type": "boolean" }, - "data": { - "title": "Data" + "is_locked": { + "title": "Locked", + "type": "boolean" }, - "desc": { - "title": "Description", - "type": "string" + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "type": { "title": "Type", "type": "string" }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", + "title": "Account", "type": "object" }, - "epss": { + "authorization": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", + "decision": { + "title": "Authorization Decision/Outcome", "type": "string" }, - "version": { - "title": "Version", - "type": "string" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" } }, - "required": [ - "score" - ], - "title": "EPSS", + "title": "Authorization Result", "type": "object" }, - "extension": { + "autonomous_system": { "additionalProperties": false, "anyOf": [ { @@ -2515,7 +2451,7 @@ }, { "required": [ - "uid" + "number" ] } ], @@ -2524,211 +2460,148 @@ "title": "Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" + "number": { + "title": "Number", + "type": "integer" } }, - "required": [ - "version" - ], - "title": "Schema Extension", + "title": "Autonomous System", "type": "object" }, - "feature": { + "classifier_details": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { "name": { "title": "Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "type": { + "title": "Type", + "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Feature", + "required": [ + "type" + ], + "title": "Classifier Details", "type": "object" }, - "file": { + "session": { "additionalProperties": false, "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "count": { + "title": "Count", "type": "integer" }, "created_time": { "title": "Created Time", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "drive_type": { - "title": "Drive Type", + "expiration_reason": { + "title": "Expiration Reason", "type": "string" }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", + "is_mfa": { + "title": "Multi Factor Authentication", "type": "boolean" }, - "is_encrypted": { - "title": "Encrypted", + "is_remote": { + "title": "Remote", "type": "boolean" }, - "is_readonly": { - "title": "Read-Only", + "is_vpn": { + "title": "VPN Session", "type": "boolean" }, - "is_system": { - "title": "System", - "type": "boolean" + "issuer": { + "title": "Issuer Details", + "type": "string" }, - "mime_type": { - "title": "MIME type", + "terminal": { + "title": "Terminal", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "uid": { + "title": "Unique ID", + "type": "string" }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "name": { "title": "Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "src_url": { + "title": "Source URL", + "type": "string" }, - "parent_folder": { - "title": "Parent Folder", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", "type": "string" }, "path": { "title": "Path", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", + "tag": { + "title": "Image Tag", "type": "string" }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -2736,106 +2609,18 @@ "title": "Tags", "type": "array" }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, "uid": { "title": "Unique ID", "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, "required": [ - "name", - "type_id" + "uid" ], - "title": "File", + "title": "Image", "type": "object" }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { + "application": { "additionalProperties": false, "anyOf": [ { @@ -2850,163 +2635,130 @@ } ], "properties": { - "category": { - "title": "Category", + "criticality": { + "title": "Business Criticality", "type": "string" }, - "condition": { - "title": "Condition", - "type": "string" + "data": { + "title": "Data" }, "desc": { - "title": "Description", + "title": "Application Description", "type": "string" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "match_details": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { "items": { "type": "string" }, - "title": "Match Details", + "title": "Labels", "type": "array" }, - "match_location": { - "title": "Match Location", - "type": "string" - }, "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", + "title": "Application Name", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "uid": { - "title": "Unique ID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "bus_type_id": { + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, - 7, 99 ], - "title": "Bus Type ID", + "title": "Risk Level ID", "type": "integer" }, - "cores": { - "title": "Cores", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "model": { - "title": "Model", + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "uid": { + "title": "Application ID", "type": "string" }, - "vram_mode": { - "title": "VRAM Mode", + "uid_alt": { + "title": "Application Alternative ID", "type": "string" }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" + "version": { + "title": "Application Version", + "type": "string" } }, - "title": "GPU Information", + "title": "Application", "type": "object" }, - "graph": { + "script": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "desc": { - "title": "Description", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "edges": { + "hashes": { "items": { - "$ref": "#/$defs/edge" + "$ref": "#/$defs/fingerprint" }, - "title": "Edges", + "title": "Hashes", "type": "array" }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, "name": { "title": "Name", "type": "string" }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" }, - "query_language": { - "title": "Query Language", + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", "type": "string" }, - "query_language_id": { + "type_id": { "enum": [ 0, 1, @@ -3018,207 +2770,141 @@ 7, 99 ], - "title": "Query Language ID", + "title": "Type ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" } }, "required": [ - "nodes" + "script_content", + "type_id" ], - "title": "Graph", + "title": "Script", "type": "object" }, - "group": { + "affected_package": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "desc": { - "title": "Description", + "architecture": { + "title": "Architecture", "type": "string" }, - "domain": { - "title": "Domain", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "name": { - "title": "Name", + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", "type": "string" }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "type": { - "title": "Group Type", + "license": { + "title": "Software License", "type": "string" }, - "uid": { - "title": "Unique ID", + "license_url": { + "title": "Software License URL", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "package_manager": { + "title": "Package Manager", "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "http_request": { - "additionalProperties": false, - "properties": { - "args": { - "title": "HTTP Arguments", + }, + "package_manager_url": { + "title": "Package Manager URL", "type": "string" }, - "body_length": { - "title": "Request Body Length", - "type": "integer" + "path": { + "title": "Path", + "type": "string" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "purl": { + "title": "Package URL", + "type": "string" }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", + "release": { + "title": "Software Release Details", "type": "string" }, - "length": { - "title": "Request Length", - "type": "integer" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "referrer": { - "title": "HTTP Referrer", + "src_url": { + "title": "Source URL", "type": "string" }, - "uid": { - "title": "Unique ID", + "type": { + "title": "Type", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "user_agent": { - "title": "HTTP User-Agent", + "uid": { + "title": "Package UID", "type": "string" }, - "version": { - "title": "HTTP Version", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" + "version": { + "title": "Version", + "type": "string" } }, - "title": "HTTP Request", + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", "type": "object" }, - "http_response": { + "cis_control": { "additionalProperties": false, "properties": { - "body_length": { - "title": "Response Body Length", - "type": "integer" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "content_type": { - "title": "HTTP Content Type", + "desc": { + "title": "Description", "type": "string" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" - }, - "length": { - "title": "Response Length", - "type": "integer" - }, - "message": { - "title": "Message", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "version": { + "title": "Version", "type": "string" } }, "required": [ - "code" + "name" ], - "title": "HTTP Response", + "title": "CIS Control", "type": "object" }, - "idp": { + "analytic": { "additionalProperties": false, "anyOf": [ { @@ -3233,44 +2919,28 @@ } ], "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" + "category": { + "title": "Category", + "type": "string" }, - "issuer": { - "title": "Issuer Details", + "desc": { + "title": "Description", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" }, "state": { "title": "State", @@ -3282,56 +2952,86 @@ 1, 2, 3, - 4, 99 ], "title": "State ID", "type": "integer" }, - "tenant_uid": { - "title": "Tenant UID", + "type": { + "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" }, - "url_string": { - "title": "Configuration URL", + "version": { + "title": "Version", "type": "string" } }, - "title": "Identity Provider", + "required": [ + "type_id" + ], + "title": "Analytic", "type": "object" }, - "image": { + "edge": { "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "relation": { + "title": "Relation", "type": "string" }, - "tag": { - "title": "Image Tag", + "source": { + "title": "Source", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "target": { + "title": "Target", + "type": "string" }, "uid": { "title": "Unique ID", @@ -3339,165 +3039,219 @@ } }, "required": [ - "uid" + "source", + "target" ], - "title": "Image", + "title": "Edge", "type": "object" }, - "kb_article": { + "actor": { "additionalProperties": false, "anyOf": [ { "required": [ - "src_url" + "app_name" ] }, { "required": [ - "uid" + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" ] } ], "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", + "app_name": { + "title": "Application Name", "type": "string" }, - "classification": { - "title": "Classification", + "app_uid": { + "title": "Application ID", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" }, - "install_state": { - "title": "Install State", + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", "type": "string" }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" + "process": { + "$ref": "#/$defs/process", + "title": "Process" }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" }, - "severity": { - "title": "Severity", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "provider": { + "title": "Cloud Provider", + "type": "string" }, - "src_url": { - "title": "Source URL", + "region": { + "title": "Region", "type": "string" }, - "title": { - "title": "Title", + "zone": { + "title": "Cloud Availability Zone", "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "KB Article", + "required": [ + "uid" + ], + "title": "Trace", "type": "object" }, - "key_value_object": { + "ai_model": { "additionalProperties": false, "anyOf": [ { "required": [ - "value" + "name" ] }, { "required": [ - "values" + "uid" ] } ], "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "name" + "ai_provider" ], - "title": "Key:Value object", + "title": "AI Model", "type": "object" }, - "keyboard_info": { + "file": { "additionalProperties": false, "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", + "parent_folder": { + "title": "Parent Folder", "type": "string" }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" + "is_system": { + "title": "System", + "type": "boolean" }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { + "confidentiality_id": { "enum": [ 0, 1, @@ -3506,111 +3260,97 @@ 4, 5, 6, - 7, 99 ], - "title": "Kill Chain Phase ID", + "title": "Confidentiality ID", "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", + }, + "uid": { + "title": "Unique ID", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" }, - "deleted_time": { - "title": "Deleted Time", + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "department": { - "title": "Department", + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", "type": "string" }, - "display_name": { - "title": "Display Name", + "company_name": { + "title": "Company Name", "type": "string" }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" + "attributes": { + "title": "Attributes", + "type": "integer" }, - "employee_uid": { - "title": "Employee ID", + "desc": { + "title": "Description", "type": "string" }, - "given_name": { - "title": "Given Name", + "type": { + "title": "Type", "type": "string" }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", + "path": { + "title": "Path", "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "uri": { + "title": "File URI", + "type": "string" }, - "last_login_time": { - "title": "Last Login", - "type": "integer" + "is_deleted": { + "title": "Deleted", + "type": "boolean" }, - "ldap_cn": { - "title": "LDAP Common Name", + "confidentiality": { + "title": "Confidentiality", "type": "string" }, - "ldap_dn": { - "title": "LDAP Distinguished Name", + "drive_type": { + "title": "Drive Type", "type": "string" }, - "leave_time": { - "title": "Leave Time", + "created_time": { + "title": "Created Time", "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" }, - "office_location": { - "title": "Office Location", - "type": "string" + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" }, - "phone_number": { - "title": "Telephone Number", + "name": { + "title": "Name", "type": "string" }, - "surname": { - "title": "Surname", - "type": "string" + "accessed_time": { + "title": "Accessed Time", + "type": "integer" }, "tags": { "items": { @@ -3618,275 +3358,182 @@ }, "title": "Tags", "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] }, - { - "required": [ - "country" - ] + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" }, - { - "required": [ - "postal_code" - ] + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" + "size": { + "title": "Size", + "type": "integer" }, - "city": { - "title": "City", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "continent": { - "title": "Continent", + "internal_name": { + "title": "Internal Name", "type": "string" }, - "coordinates": { + "hashes": { "items": { - "type": "number" + "$ref": "#/$defs/fingerprint" }, - "title": "Coordinates", + "title": "Hashes", "type": "array" }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" }, - "geodetic_altitude": { - "title": "Geodetic Altitude", + "security_descriptor": { + "title": "Security Descriptor", "type": "string" }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", + "volume": { + "title": "Volume", "type": "string" }, - "geohash": { - "title": "Geohash", - "type": "string" + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", + "mime_type": { + "title": "MIME type", "type": "string" }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" }, "product": { "$ref": "#/$defs/product", "title": "Product" }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Logger", + "required": [ + "name", + "type_id" + ], + "title": "File", "type": "object" }, - "long_string": { + "remediation": { "additionalProperties": false, "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" }, - "value": { - "title": "Value", + "desc": { + "title": "Description", "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" } }, "required": [ - "value" + "desc" ], - "title": "Long String", + "title": "Remediation", "type": "object" }, - "malware": { + "email": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "from" ] }, { "required": [ - "uid" + "to" ] } ], "properties": { - "classification_ids": { + "cc": { "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" + "type": "string" }, - "title": "Classification IDs", + "title": "Cc", "type": "array" }, - "classifications": { + "cc_mailboxes": { "items": { "type": "string" }, - "title": "Classifications", + "title": "Cc Mailboxes", "type": "array" }, - "cves": { + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { "items": { - "$ref": "#/$defs/cve" + "type": "string" }, - "title": "CVE List", + "title": "Delivered To List", "type": "array" }, "files": { @@ -3896,384 +3543,380 @@ "title": "Files", "type": "array" }, - "name": { - "title": "Name", + "from": { + "title": "From", "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" }, - "path": { - "title": "Path", + "from_mailbox": { + "title": "From Mailbox", "type": "string" }, - "provider": { - "title": "Provider", + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", "type": "string" }, - "severity": { - "title": "Severity", + "raw_header": { + "title": "Raw Header", "type": "string" }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "reply_to": { + "title": "Reply To", "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" }, - "name": { - "title": "Name", - "type": "string" + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" }, - "num_files": { - "title": "Scanned Files", - "type": "integer" + "return_path": { + "title": "Return Path", + "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" + "sender": { + "title": "Sender", + "type": "string" }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" }, "size": { "title": "Size", "type": "integer" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "smtp_from": { + "title": "SMTP From", + "type": "string" }, - "type": { - "title": "Type", + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" }, "uid": { - "title": "Scan UID", + "title": "Email Thread UID", "type": "string" }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "type_id" + "name", + "value" ], - "title": "Malware Scan Info", + "title": "Environment Variable", "type": "object" }, - "message_context": { + "technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "application" + "name" ] }, { "required": [ - "service" + "uid" ] } ], "properties": { - "ai_role": { - "title": "AI Role", - "type": "string" - }, - "ai_role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "AI Role ID", - "type": "integer" - }, - "application": { - "$ref": "#/$defs/application", - "title": "Application" - }, - "completion_tokens": { - "title": "Completion Tokens", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "prompt_tokens": { - "title": "Prompt Tokens", - "type": "integer" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "total_tokens": { - "title": "Total Tokens", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "Message Context", + "title": "MITRE Technique", "type": "object" }, - "metadata": { + "http_request": { "additionalProperties": false, "properties": { - "correlation_uid": { - "title": "Correlation UID", + "args": { + "title": "HTTP Arguments", "type": "string" }, - "debug": { + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { "items": { - "type": "string" + "$ref": "#/$defs/http_header" }, - "title": "Debug Information", + "title": "HTTP Headers", "type": "array" }, - "event_code": { - "title": "Event Code", + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", "type": "string" }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" + "length": { + "title": "Request Length", + "type": "integer" }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" + "referrer": { + "title": "HTTP Referrer", + "type": "string" }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "uid": { + "title": "Unique ID", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "log_source": { - "title": "Log Source", + "user_agent": { + "title": "HTTP User-Agent", "type": "string" }, - "log_version": { - "title": "Log Version", + "version": { + "title": "HTTP Version", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { + "x_forwarded_for": { "items": { - "$ref": "#/$defs/logger" + "type": "string" }, - "title": "Loggers", + "title": "X-Forwarded-For", "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", "type": "string" }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { + "metrics": { "items": { - "type": "string" + "$ref": "#/$defs/metric" }, - "title": "Profiles", + "title": "Metrics", "type": "array" }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" + "overall_score": { + "title": "Overall Score", + "type": "number" }, - "source": { - "title": "Source", + "severity": { + "title": "Severity", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", + "src_url": { + "title": "Source URL", "type": "string" }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", + "vector_string": { + "title": "Vector String", "type": "string" }, - "uid": { - "title": "Event UID", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, "required": [ - "product", + "base_score", "version" ], - "title": "Metadata", + "title": "CVSS Score", "type": "object" }, - "metric": { + "fingerprint": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", + "algorithm": { + "title": "Algorithm", "type": "string" }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, "value": { "title": "Value", "type": "string" } }, "required": [ - "name", + "algorithm_id", "value" ], - "title": "Metric", + "title": "Fingerprint", "type": "object" }, - "mitigation": { + "process_entity": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, { "required": [ "uid" @@ -4281,270 +3924,290 @@ } ], "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "path": { + "title": "Path", "type": "string" }, + "pid": { + "title": "Process ID", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "MITRE Mitigation", + "title": "Process Entity", "type": "object" }, - "network_endpoint": { + "observable": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" }, - { - "required": [ - "hostname" - ] + "name": { + "title": "Name", + "type": "string" }, - { - "required": [ - "instance_uid" - ] + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - { - "required": [ - "interface_name" - ] + "type": { + "title": "Type", + "type": "string" }, - { - "required": [ - "interface_uid" - ] + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" }, - { - "required": [ - "ip" - ] + "type_uid": { + "title": "Type ID", + "type": "integer" }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "name" + "sub_technique" ] }, { "required": [ - "svc_name" + "tactic" ] }, { "required": [ - "uid" + "technique" ] } ], "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" }, - "domain": { - "title": "Domain", - "type": "string" + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" }, - "fingerprints": { + "tactics": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/tactic" }, - "title": "Fingerprints", + "title": "Tactics", "type": "array" }, - "hostname": { - "title": "Hostname", + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + { + "required": [ + "ip" + ] }, - "instance_uid": { - "title": "Instance ID", - "type": "string" + { + "required": [ + "mac" + ] }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" + { + "required": [ + "name" + ] }, - "interface_uid": { - "title": "Network Interface ID", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", "type": "string" }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, "ip": { "title": "IP Address", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, "mac": { "title": "MAC Address", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", "type": "integer" }, - "network_scope": { - "title": "Network Scope", + "type": { + "title": "Type", "type": "string" }, - "network_scope_id": { + "type_id": { "enum": [ 0, 1, 2, + 3, + 4, 99 ], - "title": "Network Scope ID", + "title": "Type ID", "type": "integer" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] }, { "required": [ @@ -4558,35 +4221,86 @@ } ], "properties": { - "hostname": { - "title": "Hostname", + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "ip": { - "title": "IP Address", + "display_name": { + "title": "Display Name", "type": "string" }, - "mac": { - "title": "MAC Address", + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", "type": "string" }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, "name": { "title": "Name", "type": "string" }, - "namespace": { - "title": "Namespace", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "open_ports": { + "programmatic_credentials": { "items": { - "$ref": "#/$defs/port_info" + "$ref": "#/$defs/programmatic_credential" }, - "title": "Open Ports", + "title": "Programmatic Credentials", "type": "array" }, - "subnet_prefix": { - "title": "Subnet Prefix Length", + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", "type": "integer" }, "type": { @@ -4608,191 +4322,264 @@ "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "title": "Network Interface", + "title": "User", "type": "object" }, - "network_proxy": { + "auth_factor": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - { - "required": [ - "hostname" - ] + "email_addr": { + "title": "Email Address", + "type": "string" }, - { - "required": [ - "instance_uid" - ] + "factor_type": { + "title": "Factor Type", + "type": "string" }, - { - "required": [ - "interface_name" - ] + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" }, - { - "required": [ - "interface_uid" - ] + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" }, - { - "required": [ - "ip" - ] + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" }, - { - "required": [ - "name" - ] + "phone_number": { + "title": "Phone Number", + "type": "string" }, - { - "required": [ - "svc_name" - ] + "provider": { + "title": "Provider", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { + "security_questions": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "Security Questions", "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { "items": { - "$ref": "#/$defs/fingerprint" + "type": "string" }, - "title": "Fingerprints", + "title": "References", "type": "array" }, - "hostname": { - "title": "Hostname", + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" }, - "instance_uid": { - "title": "Instance ID", + "detection_pattern": { + "title": "Detection Pattern", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "category": { + "title": "Category", "type": "string" }, - "intermediate_ips": { + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { "items": { "type": "string" }, - "title": "Intermediate IP Addresses", + "title": "Related Subdomains", "type": "array" }, - "ip": { - "title": "IP Address", + "confidence": { + "title": "Confidence", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "isp_org": { - "title": "ISP Org", + "type": { + "title": "Type", "type": "string" }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, "location": { "$ref": "#/$defs/location", "title": "Geo Location" }, - "mac": { - "title": "MAC Address", + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", "type": "string" }, - "name": { - "title": "Name", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "network_scope": { - "title": "Network Scope", + "name": { + "title": "Name", "type": "string" }, - "network_scope_id": { + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", + "title": "Detection Pattern Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", + "detection_pattern_type": { + "title": "Detection Pattern", "type": "string" }, - "svc_name": { - "title": "Service Name", - "type": "string" + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" }, "type_id": { "enum": [ @@ -4811,155 +4598,105 @@ 12, 13, 14, - 15, 99 ], - "title": "Type ID", + "title": "Indicator Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" }, - "zone": { - "title": "Network Zone", + "severity": { + "title": "Severity", "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "node": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" }, - "desc": { - "title": "Description", - "type": "string" + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" }, - "name": { - "title": "Name", + "src_url": { + "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "subnet": { + "title": "Related Subnet", "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" } }, "required": [ - "uid" + "type_id", + "value" ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", + "title": "OSINT", "type": "object" }, - "observable": { + "san": { "additionalProperties": false, "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, "type": { "title": "Type", "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" } }, "required": [ - "type_id" + "name", + "type" ], - "title": "Observable", + "title": "Subject Alternative Name", "type": "object" }, "occurrence_details": { @@ -5052,7 +4789,7 @@ "title": "Occurrence Details", "type": "object" }, - "organization": { + "firewall_rule": { "additionalProperties": false, "anyOf": [ { @@ -5067,69 +4804,142 @@ } ], "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "ou_name": { - "title": "Org Unit Name", + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", "type": "string" }, - "ou_uid": { - "title": "Org Unit ID", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Organization", + "title": "Firewall Rule", "type": "object" }, - "os": { + "threat_actor": { "additionalProperties": false, "properties": { - "build": { - "title": "OS Build", + "name": { + "title": "Name", "type": "string" }, - "country": { - "title": "Country", + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", "type": "string" }, "cpe_name": { "title": "The product CPE identifier", "type": "string" }, - "cpu_bits": { - "title": "CPU Bits", + "epoch": { + "title": "Epoch", "type": "integer" }, - "edition": { - "title": "OS Edition", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "kernel_release": { - "title": "Kernel Release", + "license": { + "title": "Software License", "type": "string" }, - "lang": { - "title": "Language", + "license_url": { + "title": "Software License URL", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "sp_name": { - "title": "OS Service Pack", + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, "type": { "title": "Type", "type": "string" @@ -5137,21 +4947,21 @@ "type_id": { "enum": [ 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 + 1, + 2, + 99 ], "title": "Type ID", "type": "integer" }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, "version": { "title": "Version", "type": "string" @@ -5159,469 +4969,313 @@ }, "required": [ "name", - "type_id" + "version" ], - "title": "Operating System (OS)", + "title": "Software Package", "type": "object" }, - "osint": { + "transformation_info": { "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "comment": { - "title": "Analyst Comments", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", "type": "string" }, - "confidence": { - "title": "Confidence", + "name": { + "title": "Name", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "created_time": { - "title": "Created Time", + "time": { + "title": "Event Time", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", + "uid": { + "title": "Unique ID", "type": "string" }, - "detection_pattern_type": { - "title": "Detection Pattern", + "url_string": { + "title": "URL String", "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", "type": "integer" }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "data": { + "title": "Data" }, - "external_uid": { - "title": "External ID", + "error": { + "title": "Error Code", "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" + "error_message": { + "title": "Error Message", + "type": "string" }, - "intrusion_sets": { + "flags": { "items": { "type": "string" }, - "title": "Intrusion Sets", + "title": "Flags", "type": "array" }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + { + "required": [ + "ip" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "name" + ] }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "ip": { + "title": "IP Address", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, "uid": { "title": "Unique ID", "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, - "required": [ - "name", - "version" - ], - "title": "Software Package", + "title": "Reporter", "type": "object" }, - "policy": { + "url": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" - ] - }, - { - "required": [ - "type" + "path" ] }, { "required": [ - "uid" + "url_string" ] } ], "properties": { - "data": { - "title": "Data" + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" }, - "desc": { - "title": "Description", + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "hostname": { + "title": "Hostname", + "type": "string" }, - "is_applied": { - "title": "Applied", - "type": "boolean" + "path": { + "title": "Path", + "type": "string" }, - "name": { - "title": "Name", + "port": { + "title": "Port", + "type": "integer" + }, + "query_string": { + "title": "HTTP Query String", + "type": "string" + }, + "resource_type": { + "title": "Resource Type", "type": "string" }, - "type": { - "title": "Type", + "scheme": { + "title": "Scheme", "type": "string" }, - "uid": { - "title": "Unique ID", + "subdomain": { + "title": "Subdomain", "type": "string" }, - "version": { - "title": "Version", + "url_string": { + "title": "URL String", "type": "string" } }, - "title": "Policy", + "title": "Uniform Resource Locator", "type": "object" }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", "type": "object" }, - "process": { + "extension": { "additionalProperties": false, "anyOf": [ { "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" + "name" ] }, { @@ -5631,52 +5285,33 @@ } ], "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", + "name": { + "title": "Name", "type": "string" }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "cpid": { - "title": "Common Process Identifier", + "uid": { + "title": "Unique ID", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", "type": "string" }, - "integrity_id": { + "bus_type_id": { "enum": [ 0, 1, @@ -5685,153 +5320,69 @@ 4, 5, 6, + 7, 99 ], - "title": "Integrity Level", + "title": "Bus Type ID", "type": "integer" }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", + "cores": { + "title": "Cores", "type": "integer" }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", + "model": { + "title": "Model", "type": "string" }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" + "vram_mode": { + "title": "VRAM Mode", + "type": "string" }, - "terminated_time": { - "title": "Terminated Time", + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", "type": "integer" }, - "tid": { - "title": "Thread ID", + "vram_size": { + "title": "VRAM Size", "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, - "title": "Process", + "title": "GPU Information", "type": "object" }, - "process_entity": { + "port_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", + "port": { + "title": "Port", "type": "integer" }, - "uid": { - "title": "Unique ID", + "protocol_name": { + "title": "Protocol Name", "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" } }, - "title": "Process Entity", + "required": [ + "port" + ], + "title": "Port Information", "type": "object" }, - "product": { + "service": { "additionalProperties": false, "anyOf": [ { @@ -5846,123 +5397,120 @@ } ], "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "uid": { "title": "Unique ID", "type": "string" }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Product", + "title": "Service", "type": "object" }, - "programmatic_credential": { + "metric": { "additionalProperties": false, "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", + "name": { + "title": "Name", "type": "string" }, - "uid": { - "title": "Unique ID", + "value": { + "title": "Value", "type": "string" } }, "required": [ - "uid" + "name", + "value" ], - "title": "Programmatic Credential", + "title": "Metric", "type": "object" }, - "remediation": { + "request": { "additionalProperties": false, "properties": { - "cis_controls": { + "containers": { "items": { - "$ref": "#/$defs/cis_control" + "$ref": "#/$defs/container" }, - "title": "CIS Controls", + "title": "Containers", "type": "array" }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "data": { + "title": "Data" }, - "kb_articles": { + "flags": { "items": { "type": "string" }, - "title": "Knowledgebase Articles", + "title": "Flags", "type": "array" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "uid": { + "title": "Unique ID", + "type": "string" } }, "required": [ - "desc" + "uid" ], - "title": "Remediation", + "title": "Request Elements", "type": "object" }, - "reporter": { + "sub_technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "name" ] }, { "required": [ - "ip" + "uid" ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ { "required": [ "name" @@ -5975,46 +5523,153 @@ } ], "properties": { - "hostname": { - "title": "Hostname", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "ip": { - "title": "IP Address", - "type": "string" + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "network_driver": { + "title": "Network Driver", + "type": "string" + }, + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "Reporter", + "title": "Container", "type": "object" }, - "reputation": { + "malware": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" + }, + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" }, "provider": { "title": "Provider", "type": "string" }, - "score": { - "title": "Reputation Score", + "severity": { + "title": "Severity", "type": "string" }, - "score_id": { + "severity_id": { "enum": [ 0, 1, @@ -6023,42 +5678,10 @@ 4, 5, 6, - 7, - 8, - 9, - 10, 99 ], - "title": "Reputation Score ID", + "title": "Severity ID", "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" }, "uid": { "title": "Unique ID", @@ -6066,92 +5689,145 @@ } }, "required": [ - "uid" + "classification_ids" ], - "title": "Request Elements", + "title": "Malware", "type": "object" }, - "resource_details": { + "win_win_service": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "cmd_line" ] }, { "required": [ - "uid" + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" ] } ], "properties": { - "agent_list": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "Labels", "type": "array" }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "criticality": { - "title": "Criticality", + "load_order_group": { + "title": "Load Order Group", "type": "string" }, - "data": { - "title": "Data" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "hostname": { - "title": "Hostname", + "name": { + "title": "Name", "type": "string" }, - "ip": { - "title": "IP Address", + "service_category": { + "title": "Service Category", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" }, - "labels": { + "service_dependencies": { "items": { "type": "string" }, - "title": "Labels", + "title": "Service Dependencies", "type": "array" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" }, - "name": { - "title": "Name", + "service_error_control": { + "title": "Service Error Control", "type": "string" }, - "namespace": { - "title": "Namespace", + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "service_start_type": { + "title": "Service Start Type", + "type": "string" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" }, - "role": { - "title": "Role", + "service_type": { + "title": "Service Type", "type": "string" }, - "role_id": { + "service_type_id": { "enum": [ 0, 1, @@ -6160,7 +5836,7 @@ 4, 99 ], - "title": "Role ID", + "title": "Service Type ID", "type": "integer" }, "tags": { @@ -6170,69 +5846,99 @@ "title": "Tags", "type": "array" }, - "type": { - "title": "Type", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Resource Details", + "required": [ + "name" + ], + "title": "Windows Service", "type": "object" }, - "response": { + "group": { "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" + "anyOf": [ + { + "required": [ + "name" + ] }, - "data": { - "title": "Data" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" }, - "error": { - "title": "Error Code", + "domain": { + "title": "Domain", "type": "string" }, - "error_message": { - "title": "Error Message", + "name": { + "title": "Name", "type": "string" }, - "flags": { + "privileges": { "items": { "type": "string" }, - "title": "Flags", + "title": "Privileges", "type": "array" }, - "message": { - "title": "Message", + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", "type": "string" } }, - "title": "Response Elements", + "title": "Group", "type": "object" }, - "rule": { + "device": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" @@ -6245,114 +5951,157 @@ } ], "properties": { - "category": { - "title": "Category", + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", "type": "string" }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, "desc": { "title": "Description", "type": "string" }, - "name": { - "title": "Name", + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", "type": "string" }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "version": { - "title": "Version", + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", "type": "string" }, - "type": { - "title": "Type", + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "sbom": { - "additionalProperties": false, - "properties": { + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, "created_time": { "title": "Created Time", "type": "integer" }, - "package": { - "$ref": "#/$defs/package", - "title": "Software Package" + "is_shared": { + "title": "Shared Device", + "type": "boolean" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "software_components": { + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { "items": { - "$ref": "#/$defs/software_component" + "$ref": "#/$defs/group" }, - "title": "Software Components", + "title": "Groups", "type": "array" }, - "type": { - "title": "Type", + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "uid": { - "title": "SBOM ID", + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "version": { - "title": "Version", + "udid": { + "title": "Unique Device Identifier", "type": "string" - } - }, - "required": [ - "package", - "software_components" - ], - "title": "Software Bill of Materials", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", + }, + "model": { + "title": "Model", "type": "string" }, - "auth_protocol_id": { + "type_id": { "enum": [ 0, 1, @@ -6367,58 +6116,39 @@ 10, 11, 12, + 13, + 14, + 15, 99 ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", + "title": "Type ID", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "last_seen_time": { + "title": "Last Seen", + "type": "integer" }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "rate_limit": { - "title": "Rate Limit", + "boot_time": { + "title": "Boot Time", "type": "integer" }, - "scim_group_schema": { - "title": "SCIM Group Schema" + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" }, - "scim_user_schema": { - "title": "SCIM User Schema" + "is_managed": { + "title": "Managed Device", + "type": "boolean" }, - "state": { - "title": "State", - "type": "string" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "state_id": { + "risk_level_id": { "enum": [ 0, 1, @@ -6427,234 +6157,208 @@ 4, 99 ], - "title": "State ID", + "title": "Risk Level ID", "type": "integer" }, - "uid": { - "title": "Unique ID", + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", "type": "string" }, - "uid_alt": { - "title": "External ID", + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", "type": "string" }, - "url_string": { - "title": "SCIM Endpoint URL", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "vendor_name": { - "title": "Service Provider", + "subnet": { + "title": "Subnet", "type": "string" }, - "version": { - "title": "SCIM Version", + "eid": { + "title": "EID", "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" }, - "hashes": { + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/agent" }, - "title": "Hashes", + "title": "Agent List", "type": "array" }, - "name": { - "title": "Name", + "ip": { + "title": "IP Address", "type": "string" }, - "parent_uid": { - "title": "Parent Unique ID", + "hostname": { + "title": "Hostname", "type": "string" }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" }, - "uid": { - "title": "Unique ID", + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, "required": [ - "script_content", "type_id" ], - "title": "Script", + "title": "Device", "type": "object" }, - "service": { + "campaign": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, "name": { "title": "Name", "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, - "title": "Service", + "required": [ + "name" + ], + "title": "Campaign", "type": "object" }, - "session": { + "cwe": { "additionalProperties": false, "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", + "caption": { + "title": "Caption", "type": "string" }, - "terminal": { - "title": "Terminal", + "src_url": { + "title": "Source URL", "type": "string" }, "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", + "title": "CWE ID", "type": "string" } }, - "title": "Session", + "required": [ + "uid" + ], + "title": "CWE", "type": "object" }, - "software_component": { + "digital_signature": { "additionalProperties": false, "properties": { - "author": { - "title": "Author", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" }, - "license": { - "title": "Software License", - "type": "string" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" }, - "name": { - "title": "Name", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "purl": { - "title": "Package URL", + "developer_uid": { + "title": "Developer UID", "type": "string" }, - "related_component": { - "title": "Related Component", - "type": "string" + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" }, - "relationship": { - "title": "Relationship", + "state": { + "title": "State", "type": "string" }, - "relationship_id": { + "state_id": { "enum": [ 0, 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, 99 ], - "title": "Relationship ID", + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", "type": "integer" }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, "type": { "title": "Type", "type": "string" @@ -6670,74 +6374,107 @@ "title": "Type ID", "type": "integer" }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, "version": { "title": "Version", "type": "string" } }, "required": [ - "name", - "version" + "package", + "software_components" ], - "title": "Software Component", + "title": "Software Bill of Materials", "type": "object" }, - "span": { + "malware_scan_info": { "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "end_time": { "title": "End Time", "type": "integer" }, - "message": { - "title": "Message", + "name": { + "title": "Name", "type": "string" }, - "operation": { - "title": "Operation", - "type": "string" + "num_files": { + "title": "Scanned Files", + "type": "integer" }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" }, "start_time": { "title": "Start Time", "type": "integer" }, - "status_code": { - "title": "Status Code", + "type": { + "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, "uid": { - "title": "Unique ID", + "title": "Scan UID", "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" } }, "required": [ - "end_time", - "start_time", - "uid" + "type_id" ], - "title": "Span", + "title": "Malware Scan Info", "type": "object" }, - "sso": { + "kill_chain_phase": { "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "phase": { + "title": "Kill Chain Phase", "type": "string" }, - "auth_protocol_id": { + "phase_id": { "enum": [ 0, 1, @@ -6747,76 +6484,19 @@ 5, 6, 7, - 8, - 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", + "title": "Kill Chain Phase ID", "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" } }, - "title": "SSO", + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", "type": "object" }, - "sub_technique": { + "organization": { "additionalProperties": false, "anyOf": [ { @@ -6835,19 +6515,60 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", "type": "string" }, - "uid": { - "title": "Unique ID", + "type": { + "title": "Encryption Type", "type": "string" } }, - "title": "MITRE Sub-technique", + "title": "Encryption Details", "type": "object" }, - "tactic": { + "logger": { "additionalProperties": false, "anyOf": [ { @@ -6862,23 +6583,71 @@ } ], "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "MITRE Tactic", + "title": "Logger", "type": "object" }, - "technique": { + "feature": { "additionalProperties": false, "anyOf": [ { @@ -6897,46 +6666,16 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" }, - "type": { - "title": "Threat Actor Type", + "version": { + "title": "Version", "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" } }, - "required": [ - "name" - ], - "title": "Threat Actor", + "title": "Feature", "type": "object" }, "timespan": { @@ -7026,16 +6765,177 @@ "title": "Duration Years", "type": "integer" }, - "end_time": { - "title": "End Time", - "type": "integer" + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" + } + }, + "title": "Time Span", + "type": "object" + }, + "rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" }, "type": { - "title": "Time Span Type", + "title": "Agent Type", "type": "string" }, "type_id": { @@ -7052,321 +6952,348 @@ 9, 99 ], - "title": "Time Span Type ID", + "title": "Type ID", "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" } }, - "title": "Time Span", + "title": "Agent", "type": "object" }, - "token": { + "whois": { "additionalProperties": false, "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, "created_time": { - "title": "Created Time", + "title": "Registered At", "type": "integer" }, - "expiration_time": { - "title": "Expiration Time", + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", "type": "integer" }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" + "domain": { + "title": "Domain", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" }, - "name": { - "title": "Name", + "email_addr": { + "title": "Registrar Abuse Email Address", "type": "string" }, - "tenant_uid": { - "title": "Tenant UID", + "isp": { + "title": "ISP Name", "type": "string" }, - "type": { - "title": "Type", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", + "last_seen_time": { + "title": "Last Updated At", "type": "integer" }, - "uid": { - "title": "Unique ID", + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", "type": "string" }, - "zone": { - "title": "Network Zone", + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", "type": "string" } }, - "title": "Token", + "title": "WHOIS", "type": "object" }, - "trace": { + "key_value_object": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { "additionalProperties": false, "properties": { - "duration": { - "title": "Duration Milliseconds", + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", "type": "integer" }, - "end_time": { - "title": "End Time", + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", "type": "integer" }, - "flags": { + "debug": { "items": { "type": "string" }, - "title": "Flags", + "title": "Debug Information", "type": "array" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" }, - "uid": { - "title": "Unique ID", + "log_provider": { + "title": "Log Provider", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", + "event_code": { + "title": "Event Code", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "time": { - "title": "Event Time", - "type": "integer" + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" }, - "uid": { - "title": "Unique ID", + "correlation_uid": { + "title": "Correlation UID", "type": "string" }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { + "labels": { "items": { "type": "string" }, - "title": "Website Categorization", + "title": "Labels", "type": "array" }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" + "sequence": { + "title": "Sequence Number", + "type": "integer" }, - "domain": { - "title": "Domain", - "type": "string" + "transmit_time": { + "title": "Transmission Time", + "type": "integer" }, - "hostname": { - "title": "Hostname", - "type": "string" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "path": { - "title": "Path", + "original_time": { + "title": "Original Time", "type": "string" }, - "port": { - "title": "Port", - "type": "integer" + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" }, - "query_string": { - "title": "HTTP Query String", - "type": "string" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "resource_type": { - "title": "Resource Type", + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "scheme": { - "title": "Scheme", + "name": { + "title": "Name", "type": "string" }, - "subdomain": { - "title": "Subdomain", + "type": { + "title": "Type", "type": "string" }, - "url_string": { - "title": "URL String", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Uniform Resource Locator", + "required": [ + "uid" + ], + "title": "Node", "type": "object" }, - "user": { + "product": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "account" - ] - }, { "required": [ "name" @@ -7379,549 +7306,622 @@ } ], "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "display_name": { - "title": "Display Name", + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", "type": "string" }, - "domain": { - "title": "Domain", + "name": { + "title": "Name", "type": "string" }, - "email_addr": { - "title": "Email Address", + "path": { + "title": "Path", "type": "string" }, - "forward_addr": { - "title": "Forwarding Address", + "uid": { + "title": "Unique ID", "type": "string" }, - "full_name": { - "title": "Full Name", + "url_string": { + "title": "URL String", "type": "string" }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" + "vendor_name": { + "title": "Vendor Name", + "type": "string" }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" + "bulletin": { + "title": "Patch Bulletin", + "type": "string" }, - "name": { - "title": "Name", + "classification": { + "title": "Classification", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "phone_number": { - "title": "Telephone Number", + "desc": { + "title": "Description", "type": "string" }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", + "install_state": { + "title": "Install State", "type": "string" }, - "risk_level_id": { + "install_state_id": { "enum": [ 0, 1, 2, 3, - 4, 99 ], - "title": "Risk Level ID", + "title": "Install State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", "type": "integer" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", "type": "string" } }, - "title": "User", + "required": [ + "uid" + ], + "title": "Advisory", "type": "object" }, - "vulnerability": { + "network_endpoint": { "additionalProperties": false, - "oneOf": [ + "anyOf": [ { - "not": { - "required": [ - "cve", - "cwe" - ] - }, "required": [ - "advisory" + "domain" ] }, { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, "required": [ - "cve" + "hostname" ] }, { - "not": { - "required": [ - "advisory", - "cve" - ] - }, "required": [ - "cwe" + "instance_uid" ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "interface_name": { + "title": "Network Interface Name", + "type": "string" }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" + "uid": { + "title": "Unique ID", + "type": "string" }, - "category": { - "title": "Category", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "port": { + "title": "Port", + "type": "integer" }, - "dependency_chain": { - "title": "Dependency Chain", + "type": { + "title": "Type", "type": "string" }, - "desc": { - "title": "Description", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" + "mac": { + "title": "MAC Address", + "type": "string" }, - "exploit_ref_url": { - "title": "Exploit URL", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", "type": "string" }, - "exploit_requirement": { - "title": "Exploit Requirement", + "isp": { + "title": "ISP Name", "type": "string" }, - "exploit_type": { - "title": "Exploit Type", + "zone": { + "title": "Network Zone", "type": "string" }, - "first_seen_time": { - "title": "First Seen", + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - "fix_coverage": { - "title": "Fix Coverage", + "svc_name": { + "title": "Service Name", "type": "string" }, - "fix_coverage_id": { + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Fix Coverage ID", + "title": "Type ID", "type": "integer" }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" + "network_scope": { + "title": "Network Scope", + "type": "string" }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "kb_articles": { + "intermediate_ips": { "items": { "type": "string" }, - "title": "Knowledgebase Articles", + "title": "Intermediate IP Addresses", "type": "array" }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "isp_org": { + "title": "ISP Org", + "type": "string" }, - "packages": { + "fingerprints": { "items": { - "$ref": "#/$defs/package" + "$ref": "#/$defs/fingerprint" }, - "title": "Software Packages", + "title": "Fingerprints", "type": "array" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "vpc_uid": { + "title": "VPC UID", + "type": "string" }, - "related_vulnerabilities": { + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { "items": { - "type": "string" + "$ref": "#/$defs/agent" }, - "title": "Related Vulnerability IDs", + "title": "Agent List", "type": "array" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "ip": { + "title": "IP Address", + "type": "string" }, - "severity": { - "title": "Severity", + "hostname": { + "title": "Hostname", "type": "string" }, - "title": { - "title": "Title", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "title": "Vulnerability Details", + "title": "Network Endpoint", "type": "object" }, - "whois": { + "d3f_tactic": { "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, - "dnssec_status": { - "title": "DNSSEC Status", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "domain": { - "title": "Domain", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" }, - "domain_contacts": { + "cvss": { "items": { - "$ref": "#/$defs/domain_contact" + "$ref": "#/$defs/cvss" }, - "title": "Domain Contacts", + "title": "CVSS Score", "type": "array" }, - "email_addr": { - "title": "Registrar Abuse Email Address", + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", "type": "string" }, - "isp": { - "title": "ISP Name", + "cwe_url": { + "title": "CWE URL", "type": "string" }, - "isp_org": { - "title": "ISP Org", + "desc": { + "title": "Description", "type": "string" }, - "last_seen_time": { - "title": "Last Updated At", + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "name_servers": { + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { "items": { "type": "string" }, - "title": "Name Servers", + "title": "References", "type": "array" }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" }, - "registrar": { - "title": "Domain Registrar", + "title": { + "title": "Title", "type": "string" }, - "status": { - "title": "Domain Status", + "type": { + "title": "Vulnerability Type", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", + "uid": { + "title": "CVE ID", "type": "string" } }, - "title": "WHOIS", + "required": [ + "uid" + ], + "title": "CVE", "type": "object" }, - "win_win_service": { + "domain_contact": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" }, - { - "required": [ - "service_category_id" - ] + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" }, - { - "required": [ - "service_dependencies" - ] + "name": { + "title": "Name", + "type": "string" }, - { - "required": [ - "service_error_control_id" - ] + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "service_start_name" + "name" ] }, { "required": [ - "service_start_type_id" + "type" ] }, { "required": [ - "service_type_id" + "uid" ] } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" + "data": { + "title": "Data" }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" + "desc": { + "title": "Description", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" + "is_applied": { + "title": "Applied", + "type": "boolean" }, "name": { "title": "Name", "type": "string" }, - "service_category": { - "title": "Service Category", + "type": { + "title": "Type", "type": "string" }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", + "uid": { + "title": "Unique ID", "type": "string" }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" + "end_time": { + "title": "End Time", + "type": "integer" }, - "service_start_name": { - "title": "Service Start Name", + "message": { + "title": "Message", "type": "string" }, - "service_start_type": { - "title": "Service Start Type", + "operation": { + "title": "Operation", "type": "string" }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "status_code": { + "title": "Status Code", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "name" + "end_time", + "start_time", + "uid" ], - "title": "Windows Service", + "title": "Span", "type": "object" } }, @@ -7929,72 +7929,107 @@ "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Activity ID", - "type": "integer" + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" }, - "activity_name": { - "title": "Activity", + "message": { + "title": "Message", "type": "string" }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" }, - "ai_model": { - "$ref": "#/$defs/ai_model", - "title": "AI Model" + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" }, "api": { "$ref": "#/$defs/api", "title": "API Details" }, - "category_name": { - "title": "Category", - "type": "string" + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" }, - "category_uid": { - "const": 6, - "title": "Category ID", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "class_name": { - "title": "Class", + "status_detail": { + "title": "Status Detail", "type": "string" }, - "class_uid": { - "const": 6003, - "title": "Class ID", + "status_code": { + "title": "Status Code", + "type": "string" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", "type": "integer" }, - "count": { - "title": "Count", + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", "type": "integer" }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "status": { + "title": "Status", + "type": "string" }, - "end_time": { - "title": "End Time", + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", "type": "integer" }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, "enrichments": { "items": { "$ref": "#/$defs/enrichment" @@ -8006,52 +8041,51 @@ "$ref": "#/$defs/http_request", "title": "HTTP Request" }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" - }, - "message": { - "title": "Message", - "type": "string" + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" }, - "message_context": { - "$ref": "#/$defs/message_context", - "title": "Message Context" + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" + "activity_name": { + "title": "Activity", + "type": "string" }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "raw_data": { - "title": "Raw Data", + "class_name": { + "title": "Class", "type": "string" }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" }, "raw_data_size": { "title": "Raw Data Size", "type": "integer" }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Resources Array", - "type": "array" + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, "severity": { "title": "Severity", "type": "string" }, + "category_name": { + "title": "Category", + "type": "string" + }, "severity_id": { "enum": [ 0, @@ -8066,59 +8100,25 @@ "title": "Severity ID", "type": "integer" }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", + "count": { + "title": "Count", "type": "integer" }, - "timezone_offset": { - "title": "Timezone Offset", + "end_time": { + "title": "End Time", "type": "integer" }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, "type_uid": { "title": "Type ID", "type": "integer" }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" } }, "required": [ diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json index ba8a7817d8..6c8cf83eb1 100644 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+security_control+trace.json @@ -1,11 +1,11 @@ { "$defs": { - "account": { + "kb_article": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "src_url" ] }, { @@ -14,152 +14,6 @@ ] } ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, "properties": { "avg_timespan": { "$ref": "#/$defs/timespan", @@ -177,10 +31,6 @@ "title": "Created Time", "type": "integer" }, - "desc": { - "title": "Description", - "type": "string" - }, "install_state": { "title": "Install State", "type": "string" @@ -200,10 +50,6 @@ "title": "The patch is superseded.", "type": "boolean" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "os": { "$ref": "#/$defs/os", "title": "OS" @@ -212,26 +58,9 @@ "$ref": "#/$defs/product", "title": "Product" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, "size": { "title": "Size", @@ -246,247 +75,238 @@ "type": "string" }, "uid": { - "title": "Advisory ID", + "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Advisory", + "title": "KB Article", "type": "object" }, - "affected_code": { + "long_string": { "additionalProperties": false, "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "start_column": { - "title": "Start Column", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "file" + "value" ], - "title": "Affected Code", + "title": "Long String", "type": "object" }, - "affected_package": { + "enrichment": { "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpe_name": { - "title": "The product CPE identifier", + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "fixed_in_version": { - "title": "Fixed In Version", + "provider": { + "title": "Provider", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "license": { - "title": "Software License", + "short_desc": { + "title": "Short Description", "type": "string" }, - "license_url": { - "title": "Software License URL", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "type": { + "title": "Type", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", "type": "string" }, - "path": { - "title": "Path", + "display_name": { + "title": "Display Name", "type": "string" }, - "purl": { - "title": "Package URL", + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", "type": "string" }, - "release": { - "title": "Software Release Details", + "given_name": { + "title": "Given Name", "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "hire_time": { + "title": "Hire Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "job_title": { + "title": "Job Title", "type": "string" }, - "type": { - "title": "Type", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", "type": "integer" }, - "uid": { - "title": "Package UID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "version": { - "title": "Version", + "surname": { + "title": "Surname", "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" } }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", + "title": "LDAP Person", "type": "object" }, - "agent": { + "email_auth": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Agent Name", + "dkim": { + "title": "DKIM Status", "type": "string" }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", + "dkim_domain": { + "title": "DKIM Domain", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" }, - "uid": { - "title": "Agent ID", + "dmarc": { + "title": "DMARC Status", "type": "string" }, - "uid_alt": { - "title": "Alternate Agent ID", + "dmarc_override": { + "title": "DMARC Override", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "dmarc_policy": { + "title": "DMARC Policy", "type": "string" }, - "version": { - "title": "Agent Version", + "spf": { + "title": "SPF Status", "type": "string" } }, - "title": "Agent", + "title": "Email Authentication", "type": "object" }, - "ai_model": { + "epss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "ai_provider": { - "title": "AI Provider", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "percentile": { + "title": "EPSS Percentile", + "type": "number" }, - "uid": { - "title": "Unique ID", + "score": { + "title": "EPPS Score", "type": "string" }, "version": { @@ -495,54 +315,35 @@ } }, "required": [ - "ai_provider" + "score" ], - "title": "AI Model", + "title": "EPSS", "type": "object" }, - "analytic": { + "device_hw_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", + "bios_manufacturer": { + "title": "BIOS Manufacturer", "type": "string" }, - "desc": { - "title": "Description", + "bios_ver": { + "title": "BIOS Version", "type": "string" }, - "name": { - "title": "Name", + "chassis": { + "title": "Chassis", "type": "string" }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", + "cpu_architecture": { + "title": "CPU Architecture", "type": "string" }, - "state_id": { + "cpu_architecture_id": { "enum": [ 0, 1, @@ -550,93 +351,111 @@ 3, 99 ], - "title": "State ID", + "title": "CPU Architecture ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", + "cpu_cores": { + "title": "CPU Cores", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "cpu_count": { + "title": "CPU Count", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" }, - "operation": { - "title": "Operation", + "cpu_type": { + "title": "Processor Type", "type": "string" }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" + "gpu_count": { + "title": "GPU Count", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" }, - "version": { - "title": "Version", + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "required": [ - "operation" - ], - "title": "API", + "title": "Device Hardware Info", "type": "object" }, - "application": { + "network_proxy": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -644,166 +463,130 @@ } ], "properties": { - "criticality": { - "title": "Business Criticality", - "type": "string" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "data": { - "title": "Data" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "desc": { - "title": "Application Description", + "domain": { + "title": "Domain", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" }, "hostname": { "title": "Hostname", "type": "string" }, - "labels": { + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { "items": { "type": "string" }, - "title": "Labels", + "title": "Intermediate IP Addresses", "type": "array" }, - "name": { - "title": "Application Name", + "ip": { + "title": "IP Address", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Application Relationship" + "isp": { + "title": "ISP Name", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "sbom": { - "$ref": "#/$defs/sbom", - "title": "Related SBOM" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Application Type", + "mac": { + "title": "MAC Address", "type": "string" }, - "uid": { - "title": "Application ID", + "mac_vendor": { + "title": "MAC Vendor", "type": "string" }, - "uid_alt": { - "title": "Application Alternative ID", + "name": { + "title": "Name", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Application Version", + "network_scope": { + "title": "Network Scope", "type": "string" - } - }, - "title": "Application", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] }, - { - "required": [ - "tactic" - ] + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" + "port": { + "title": "Port", + "type": "integer" }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" }, - "version": { - "title": "Version", + "subnet_uid": { + "title": "Subnet UID", "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" }, - "email_addr": { - "title": "Email Address", + "svc_name": { + "title": "Service Name", "type": "string" }, - "factor_type": { - "title": "Factor Type", + "type": { + "title": "Type", "type": "string" }, - "factor_type_id": { + "type_id": { "enum": [ 0, 1, @@ -817,237 +600,189 @@ 9, 10, 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Factor Type ID", + "title": "Type ID", "type": "integer" }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", + "uid": { + "title": "Unique ID", "type": "string" }, - "provider": { - "title": "Provider", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Authorization Result", + "title": "Network Proxy Endpoint", "type": "object" }, - "autonomous_system": { + "data_classification": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "category_id" ] }, { "required": [ - "number" + "confidentiality_id" ] } ], "properties": { - "name": { - "title": "Name", + "category": { + "title": "Category", "type": "string" }, - "number": { - "title": "Number", + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" }, - "expiration_time": { - "title": "Expiration Time", + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", "type": "integer" }, - "fingerprints": { + "discovery_details": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/discovery_details" }, - "title": "Fingerprints", + "title": "Discovery Details", "type": "array" }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" + "size": { + "title": "Size", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", + "status": { + "title": "Status", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "total": { + "title": "Total", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" } }, - "required": [ - "type" - ], - "title": "Classifier Details", + "title": "Data Classification", "type": "object" }, - "cloud": { + "http_response": { "additionalProperties": false, "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" + "body_length": { + "title": "Response Body Length", + "type": "integer" }, - "cloud_partition": { - "title": "Cloud Partition", + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "project_uid": { - "title": "Project ID", - "type": "string" + "latency": { + "title": "Latency", + "type": "integer" }, - "provider": { - "title": "Cloud Provider", - "type": "string" + "length": { + "title": "Response Length", + "type": "integer" }, - "region": { - "title": "Region", + "message": { + "title": "Message", "type": "string" }, - "zone": { - "title": "Cloud Availability Zone", + "status": { + "title": "Status", "type": "string" } }, "required": [ - "provider" + "code" ], - "title": "Cloud", + "title": "HTTP Response", "type": "object" }, - "container": { + "resource_details": { "additionalProperties": false, "anyOf": [ { @@ -1062,13 +797,39 @@ } ], "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" }, "labels": { "items": { @@ -1077,34 +838,42 @@ "title": "Labels", "type": "array" }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "network_driver": { - "title": "Network Driver", + "namespace": { + "title": "Namespace", "type": "string" }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" }, - "runtime": { - "title": "Runtime", + "role": { + "title": "Role", "type": "string" }, - "size": { - "title": "Size", + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", "type": "integer" }, - "tag": { - "title": "Image Tag", - "type": "string" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -1112,167 +881,262 @@ "title": "Tags", "type": "array" }, + "type": { + "title": "Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Container", + "title": "Resource Details", "type": "object" }, - "cve": { + "display": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "color_depth": { + "title": "Color Depth", "type": "integer" }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" + "physical_height": { + "title": "Physical Height", + "type": "integer" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" + "physical_width": { + "title": "Physical Width", + "type": "integer" }, - "cwe_url": { - "title": "CWE URL", + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "desc": { - "title": "Description", + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", "type": "string" }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "name": { + "title": "Name", + "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "protocol_name": { + "title": "Supported Protocol", + "type": "string" }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "rate_limit": { + "title": "Rate Limit", + "type": "integer" }, - "title": { - "title": "Title", + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" }, "type": { - "title": "Vulnerability Type", + "title": "Type", "type": "string" }, "uid": { - "title": "CVE ID", + "title": "Unique ID", "type": "string" } }, "required": [ "uid" ], - "title": "CVE", + "title": "Programmatic Credential", "type": "object" }, - "cvss": { + "os": { "additionalProperties": false, "properties": { - "base_score": { - "title": "Base Score", - "type": "number" + "build": { + "title": "OS Build", + "type": "string" }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", + "country": { + "title": "Country", "type": "string" }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" }, - "overall_score": { - "title": "Overall Score", - "type": "number" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "severity": { - "title": "Severity", + "edition": { + "title": "OS Edition", "type": "string" }, - "src_url": { - "title": "Source URL", + "kernel_release": { + "title": "Kernel Release", "type": "string" }, - "vector_string": { - "title": "Vector String", + "lang": { + "title": "Language", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "name": { + "title": "Name", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", + "sp_name": { + "title": "OS Service Pack", "type": "string" }, - "src_url": { - "title": "Source URL", + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "uid": { - "title": "CWE ID", + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, "required": [ - "uid" + "name", + "type_id" ], - "title": "CWE", + "title": "Operating System (OS)", "type": "object" }, - "d3f_tactic": { + "tactic": { "additionalProperties": false, "anyOf": [ { @@ -1300,91 +1164,101 @@ "type": "string" } }, - "title": "MITRE D3FEND\u2122 Tactic", + "title": "MITRE Tactic", "type": "object" }, - "d3f_technique": { + "dns_answer": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "class": { + "title": "Resource Record Class", "type": "string" }, - "src_url": { - "title": "Source URL", + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", "type": "string" }, - "uid": { - "title": "Unique ID", + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", "type": "string" } }, - "title": "MITRE D3FEND\u2122 Technique", + "required": [ + "rdata" + ], + "title": "DNS Answer", "type": "object" }, - "d3fend": { + "discovery_details": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" + "count": { + "title": "Count", + "type": "integer" }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" }, - "version": { - "title": "Version", + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", "type": "string" } }, - "title": "MITRE D3FEND\u2122", + "title": "Discovery Details", "type": "object" }, - "data_classification": { + "sso": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], "properties": { - "category": { - "title": "Category", + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "category_id": { + "auth_protocol_id": { "enum": [ 0, 1, @@ -1393,114 +1267,247 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, 99 ], - "title": "Category ID", + "title": "Auth Protocol ID", "type": "integer" }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "duration_mins": { + "title": "SSO Session Duration", "type": "integer" }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" }, - "size": { - "title": "Size", + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "src_url": { - "title": "Source URL", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "status_details": { + "scopes": { "items": { "type": "string" }, - "title": "Status Details", + "title": "Scopes", "type": "array" }, - "status_id": { + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Data Classification", + "title": "Token", "type": "object" }, - "device": { + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "d3f_tactic" ] }, { "required": [ - "instance_uid" + "d3f_technique" ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" }, - { - "required": [ - "interface_name" - ] + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" }, - { - "required": [ - "interface_uid" - ] + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" }, - { - "required": [ - "ip" - ] + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ { "required": [ "name" @@ -1513,199 +1520,192 @@ } ], "properties": { - "agent_list": { + "countermeasures": { "items": { - "$ref": "#/$defs/agent" + "$ref": "#/$defs/d3fend" }, - "title": "Agent List", + "title": "Countermeasures", "type": "array" }, - "autoscale_uid": { - "title": "Autoscale UID", + "name": { + "title": "Name", "type": "string" }, - "boot_time": { - "title": "Boot Time", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "boot_uid": { - "title": "Boot UID", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] }, - "created_time": { - "title": "Created Time", - "type": "integer" + { + "required": [ + "country" + ] }, - "desc": { - "title": "Description", - "type": "string" + { + "required": [ + "postal_code" + ] }, - "domain": { - "title": "Domain", + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", "type": "string" }, - "eid": { - "title": "EID", + "city": { + "title": "City", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" + "continent": { + "title": "Continent", + "type": "string" }, - "groups": { + "coordinates": { "items": { - "$ref": "#/$defs/group" + "type": "number" }, - "title": "Groups", + "title": "Coordinates", "type": "array" }, - "hostname": { - "title": "Hostname", + "country": { + "title": "Country", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "desc": { + "title": "Description", + "type": "string" }, - "hypervisor": { - "title": "Hypervisor", + "geodetic_altitude": { + "title": "Geodetic Altitude", "type": "string" }, - "iccid": { - "title": "ICCID", + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", "type": "string" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "geohash": { + "title": "Geohash", + "type": "string" }, - "imei": { - "title": "IMEI", + "horizontal_accuracy": { + "title": "Horizontal Accuracy", "type": "string" }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" }, - "instance_uid": { - "title": "Instance ID", + "isp": { + "title": "ISP Name", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" + "lat": { + "title": "Latitude", + "type": "number" }, - "interface_uid": { - "title": "Network Interface ID", + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", "type": "string" }, - "ip": { - "title": "IP Address", + "pressure_altitude": { + "title": "Pressure Altitude", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" + "provider": { + "title": "Provider", + "type": "string" }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" }, - "mac": { - "title": "MAC Address", + "domain": { + "title": "Domain", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" }, - "meid": { - "title": "MEID", - "type": "string" + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" }, - "model": { - "title": "Model", + "issuer": { + "title": "Issuer Details", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" }, - "region": { - "title": "Region", - "type": "string" + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" }, - "risk_level": { - "title": "Risk Level", + "state": { + "title": "State", "type": "string" }, - "risk_level_id": { + "state_id": { "enum": [ 0, 1, @@ -1714,26 +1714,45 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "subnet": { - "title": "Subnet", + "uid": { + "title": "Unique ID", "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "url_string": { + "title": "Configuration URL", "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] }, - "type": { - "title": "Type", + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", "type": "string" }, - "type_id": { + "ai_role_id": { "enum": [ 0, 1, @@ -1742,371 +1761,497 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "AI Role ID", "type": "integer" }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" + "application": { + "$ref": "#/$defs/application", + "title": "Application" }, - "uid": { - "title": "Unique ID", - "type": "string" + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" }, - "uid_alt": { - "title": "Alternate ID", + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "total_tokens": { + "title": "Total Tokens", + "type": "integer" }, - "zone": { - "title": "Network Zone", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Device", + "title": "Message Context", "type": "object" }, - "device_hw_info": { + "process": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "bios_ver": { - "title": "BIOS Version", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "chassis": { - "title": "Chassis", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpu_architecture": { - "title": "CPU Architecture", + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", "type": "string" }, - "cpu_architecture_id": { + "integrity_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, 99 ], - "title": "CPU Architecture ID", + "title": "Integrity Level", "type": "integer" }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" }, - "cpu_type": { - "title": "Processor Type", + "path": { + "title": "Path", "type": "string" }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" + "pid": { + "title": "Process ID", + "type": "integer" }, - "gpu_count": { - "title": "GPU Count", + "ptid": { + "title": "Process Thread ID", "type": "integer" }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" + "sandbox": { + "title": "Sandbox", + "type": "string" }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "ram_size": { - "title": "RAM Size", + "terminated_time": { + "title": "Terminated Time", "type": "integer" }, - "serial_number": { - "title": "Serial Number", - "type": "string" + "tid": { + "title": "Thread ID", + "type": "integer" }, - "uuid": { - "title": "UUID", + "uid": { + "title": "Unique ID", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" } }, - "title": "Device Hardware Info", + "title": "Process", "type": "object" }, - "digital_signature": { + "vulnerability": { "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], "properties": { - "algorithm": { - "title": "Algorithm", + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" }, - "created_time": { - "title": "Created Time", + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", "type": "integer" }, - "developer_uid": { - "title": "Developer UID", + "exploit_ref_url": { + "title": "Exploit URL", "type": "string" }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" }, - "state": { - "title": "State", + "exploit_type": { + "title": "Exploit Type", "type": "string" }, - "state_id": { + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, 99 ], - "title": "State ID", + "title": "Fix Coverage ID", "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", "type": "integer" }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" }, - "occurrences": { + "references": { "items": { - "$ref": "#/$defs/occurrence_details" + "type": "string" }, - "title": "Occurrences", + "title": "References", "type": "array" }, - "type": { - "title": "Type", + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", "type": "string" }, - "value": { - "title": "Value", + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "title": "Discovery Details", + "title": "Vulnerability Details", "type": "object" }, - "display": { + "affected_code": { "additionalProperties": false, "properties": { - "color_depth": { - "title": "Color Depth", + "end_column": { + "title": "End Column", "type": "integer" }, - "physical_height": { - "title": "Physical Height", + "end_line": { + "title": "End Line", "type": "integer" }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "physical_width": { - "title": "Physical Width", + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", "type": "integer" }, - "scale_factor": { - "title": "Scale Factor", + "start_line": { + "title": "Start Line", "type": "integer" } }, - "title": "Display", + "required": [ + "file" + ], + "title": "Affected Code", "type": "object" }, - "dns_answer": { + "keyboard_info": { "additionalProperties": false, "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", + "function_keys": { + "title": "Function Keys", "type": "integer" }, - "rdata": { - "title": "DNS RData", + "ime": { + "title": "IME", "type": "string" }, - "ttl": { - "title": "TTL", + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", "type": "integer" }, - "type": { - "title": "Resource Record Type", + "keyboard_type": { + "title": "Keyboard Type", "type": "string" } }, - "required": [ - "rdata" - ], - "title": "DNS Answer", + "title": "Keyboard Information", "type": "object" }, - "domain_contact": { + "certificate": { "additionalProperties": false, "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" }, - "phone_number": { - "title": "Phone Number", + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", "type": "string" }, - "type": { - "title": "Domain Contact Type", + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" + "subject": { + "title": "Subject Distinguished Name", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "type_id" + "issuer", + "serial_number" ], - "title": "Domain Contact", + "title": "Digital Certificate", "type": "object" }, - "edge": { + "graph": { "additionalProperties": false, "anyOf": [ { @@ -2121,8 +2266,16 @@ } ], "properties": { - "data": { - "title": "Data" + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" }, "is_directed": { "title": "Directed", @@ -2132,16 +2285,34 @@ "title": "Name", "type": "string" }, - "relation": { - "title": "Relation", - "type": "string" + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" }, - "source": { - "title": "Source", + "query_language": { + "title": "Query Language", "type": "string" }, - "target": { - "title": "Target", + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, "uid": { @@ -2150,354 +2321,290 @@ } }, "required": [ - "source", - "target" + "nodes" ], - "title": "Edge", + "title": "Graph", "type": "object" }, - "email": { + "account": { "additionalProperties": false, "anyOf": [ { "required": [ - "from" + "name" ] }, { "required": [ - "to" + "uid" ] } ], "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" + "is_disabled": { + "title": "Disabled", + "type": "boolean" }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" + "is_locked": { + "title": "Locked", + "type": "boolean" }, - "delivered_to": { - "title": "Delivered To", - "type": "string" + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" }, - "delivered_to_list": { + "labels": { "items": { "type": "string" }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", + "title": "Labels", "type": "array" }, - "from": { - "title": "From", + "name": { + "title": "Name", "type": "string" }, - "from_list": { + "tags": { "items": { - "type": "string" + "$ref": "#/$defs/key_value_object" }, - "title": "From List", + "title": "Tags", "type": "array" }, - "from_mailbox": { - "title": "From Mailbox", + "type": { + "title": "Type", "type": "string" }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" }, - "is_read": { - "title": "Read", - "type": "boolean" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "message_uid": { - "title": "Message UID", + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "raw_header": { - "title": "Raw Header", + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", "type": "string" }, - "reply_to": { - "title": "Reply To", + "type": { + "title": "Type", "type": "string" }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" }, - "sender": { - "title": "Sender", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "sender_mailbox": { - "title": "Sender Mailbox", + "expiration_reason": { + "title": "Expiration Reason", "type": "string" }, - "size": { - "title": "Size", + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "smtp_from": { - "title": "SMTP From", - "type": "string" + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" + "is_remote": { + "title": "Remote", + "type": "boolean" }, - "subject": { - "title": "Subject", + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", "type": "string" }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", + "terminal": { + "title": "Terminal", "type": "string" }, - "dmarc_override": { - "title": "DMARC Override", + "uid": { + "title": "Unique ID", "type": "string" }, - "dmarc_policy": { - "title": "DMARC Policy", + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "spf": { - "title": "SPF Status", + "uuid": { + "title": "UUID", "type": "string" } }, - "title": "Email Authentication", + "title": "Session", "type": "object" }, - "encryption_details": { + "d3f_technique": { "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "type": { - "title": "Encryption Type", - "type": "string" + { + "required": [ + "uid" + ] } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, + ], "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, "src_url": { "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", + "title": "MITRE D3FEND\u2122 Technique", "type": "object" }, - "environment_variable": { + "image": { "additionalProperties": false, "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "path": { + "title": "Path", "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" }, - "score": { - "title": "EPPS Score", + "tag": { + "title": "Image Tag", "type": "string" }, - "version": { - "title": "Version", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "score" + "uid" ], - "title": "EPSS", + "title": "Image", "type": "object" }, - "extension": { + "application": { "additionalProperties": false, "anyOf": [ { @@ -2512,129 +2619,105 @@ } ], "properties": { - "name": { - "title": "Name", + "criticality": { + "title": "Business Criticality", "type": "string" }, - "uid": { - "title": "Unique ID", + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", "type": "string" }, - "version": { - "title": "Version", + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, "name": { - "title": "Name", + "title": "Application Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { + "owner": { "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" + "title": "Owner" }, - "company_name": { - "title": "Company Name", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" }, - "confidentiality": { - "title": "Confidentiality", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "confidentiality_id": { + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Confidentiality ID", + "title": "Risk Level ID", "type": "integer" }, - "created_time": { - "title": "Created Time", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" }, - "desc": { - "title": "Description", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", "type": "string" }, - "drive_type": { - "title": "Drive Type", + "uid": { + "title": "Application ID", "type": "string" }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "ext": { - "title": "File Extension", + "version": { + "title": "Application Version", "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" }, "hashes": { "items": { @@ -2643,90 +2726,111 @@ "title": "Hashes", "type": "array" }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "internal_name": { - "title": "Internal Name", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" + "type": { + "title": "Type", + "type": "string" }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "is_system": { - "title": "System", - "type": "boolean" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" }, - "mime_type": { - "title": "MIME type", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "modified_time": { - "title": "Modified Time", + "epoch": { + "title": "Epoch", "type": "integer" }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "package_manager": { + "title": "Package Manager", + "type": "string" }, - "parent_folder": { - "title": "Parent Folder", + "package_manager_url": { + "title": "Package Manager URL", "type": "string" }, "path": { "title": "Path", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", + "purl": { + "title": "Package URL", "type": "string" }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" + "release": { + "title": "Software Release Details", + "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "src_url": { + "title": "Source URL", + "type": "string" }, "type": { "title": "Type", @@ -2737,97 +2841,54 @@ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, - 8, 99 ], "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", + "title": "Package UID", "type": "string" }, - "uri": { - "title": "File URI", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, "version": { "title": "Version", "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, "required": [ "name", - "type_id" + "version" ], - "title": "File", + "title": "Affected Software Package", "type": "object" }, - "fingerprint": { + "cis_control": { "additionalProperties": false, "properties": { - "algorithm": { - "title": "Algorithm", + "desc": { + "title": "Description", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "value": { - "title": "Value", + "version": { + "title": "Version", "type": "string" } }, "required": [ - "algorithm_id", - "value" + "name" ], - "title": "Fingerprint", + "title": "CIS Control", "type": "object" }, - "firewall_rule": { + "analytic": { "additionalProperties": false, "anyOf": [ { @@ -2842,69 +2903,49 @@ } ], "properties": { - "category": { - "title": "Category", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "condition": { - "title": "Condition", + "category": { + "title": "Category", "type": "string" }, "desc": { "title": "Description", "type": "string" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "match_details": { + "related_analytics": { "items": { - "type": "string" + "$ref": "#/$defs/analytic" }, - "title": "Match Details", + "title": "Related Analytics", "type": "array" }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", + "state": { + "title": "State", "type": "string" }, - "rate_limit": { - "title": "Rate Limit", + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", "type": "integer" }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { + "type_id": { "enum": [ 0, 1, @@ -2914,46 +2955,31 @@ 5, 6, 7, + 8, + 9, + 10, + 11, 99 ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", + "title": "Type ID", "type": "integer" }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "vram_mode": { - "title": "VRAM Mode", + "version": { + "title": "Version", "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" } }, - "title": "GPU Information", + "required": [ + "type_id" + ], + "title": "Analytic", "type": "object" }, - "graph": { + "edge": { "additionalProperties": false, "anyOf": [ { @@ -2968,16 +2994,8 @@ } ], "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "edges": { - "items": { - "$ref": "#/$defs/edge" - }, - "title": "Edges", - "type": "array" + "data": { + "title": "Data" }, "is_directed": { "title": "Directed", @@ -2987,34 +3005,16 @@ "title": "Name", "type": "string" }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" - }, - "query_language": { - "title": "Query Language", + "relation": { + "title": "Relation", "type": "string" }, - "query_language_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Query Language ID", - "type": "integer" + "source": { + "title": "Source", + "type": "string" }, - "type": { - "title": "Type", + "target": { + "title": "Target", "type": "string" }, "uid": { @@ -3023,194 +3023,166 @@ } }, "required": [ - "nodes" + "source", + "target" ], - "title": "Graph", + "title": "Edge", "type": "object" }, - "group": { + "actor": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "app_name" ] }, { "required": [ - "uid" + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" ] } ], "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", + "app_name": { + "title": "Application Name", "type": "string" }, - "name": { - "title": "Name", + "app_uid": { + "title": "Application ID", "type": "string" }, - "privileges": { + "authorizations": { "items": { - "type": "string" + "$ref": "#/$defs/authorization" }, - "title": "Privileges", + "title": "Authorization Information", "type": "array" }, - "type": { - "title": "Group Type", - "type": "string" + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" }, - "uid": { - "title": "Unique ID", + "invoked_by": { + "title": "Invoked by", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "process": { + "$ref": "#/$defs/process", + "title": "Process" }, - "value": { - "title": "Value", - "type": "string" + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" } }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", + "title": "Actor", "type": "object" }, - "http_request": { + "cloud": { "additionalProperties": false, "properties": { - "args": { - "title": "HTTP Arguments", - "type": "string" - }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", + "cloud_partition": { + "title": "Cloud Partition", "type": "string" }, - "length": { - "title": "Request Length", - "type": "integer" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "referrer": { - "title": "HTTP Referrer", + "project_uid": { + "title": "Project ID", "type": "string" }, - "uid": { - "title": "Unique ID", + "provider": { + "title": "Cloud Provider", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", + "region": { + "title": "Region", "type": "string" }, - "version": { - "title": "HTTP Version", + "zone": { + "title": "Cloud Availability Zone", "type": "string" - }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" } }, - "title": "HTTP Request", + "required": [ + "provider" + ], + "title": "Cloud", "type": "object" }, - "http_response": { + "trace": { "additionalProperties": false, "properties": { - "body_length": { - "title": "Response Body Length", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "code": { - "title": "Response Code", + "end_time": { + "title": "End Time", "type": "integer" }, - "content_type": { - "title": "HTTP Content Type", - "type": "string" - }, - "http_headers": { + "flags": { "items": { - "$ref": "#/$defs/http_header" + "type": "string" }, - "title": "HTTP Headers", + "title": "Flags", "type": "array" }, - "latency": { - "title": "Latency", - "type": "integer" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "length": { - "title": "Response Length", - "type": "integer" + "span": { + "$ref": "#/$defs/span", + "title": "Span" }, - "message": { - "title": "Message", - "type": "string" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "status": { - "title": "Status", + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "code" + "uid" ], - "title": "HTTP Response", + "title": "Trace", "type": "object" }, - "idp": { + "ai_model": { "additionalProperties": false, "anyOf": [ { @@ -3225,588 +3197,668 @@ } ], "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", + "ai_provider": { + "title": "AI Provider", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "uid": { + "title": "Unique ID", "type": "string" }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" + "is_system": { + "title": "System", + "type": "boolean" }, - "state": { - "title": "State", - "type": "string" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" }, - "state_id": { + "confidentiality_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, 99 ], - "title": "State ID", + "title": "Confidentiality ID", "type": "integer" }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" }, - "name": { - "title": "Name", - "type": "string" + "is_readonly": { + "title": "Read-Only", + "type": "boolean" }, - "path": { - "title": "Path", + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", "type": "string" }, - "tag": { - "title": "Image Tag", + "company_name": { + "title": "Company Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "attributes": { + "title": "Attributes", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "desc": { + "title": "Description", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" + "type": { + "title": "Type", + "type": "string" }, - "bulletin": { - "title": "Patch Bulletin", + "path": { + "title": "Path", "type": "string" }, - "classification": { - "title": "Classification", + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", "type": "string" }, "created_time": { "title": "Created Time", "type": "integer" }, - "install_state": { - "title": "Install State", + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", "type": "string" }, - "install_state_id": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, + 8, 99 ], - "title": "Install State ID", + "title": "Type ID", "type": "integer" }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "size": { + "title": "Size", + "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "severity": { - "title": "Severity", + "internal_name": { + "title": "Internal Name", "type": "string" }, - "size": { - "title": "Size", + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", "type": "integer" }, - "src_url": { - "title": "Source URL", + "security_descriptor": { + "title": "Security Descriptor", "type": "string" }, - "title": { - "title": "Title", + "volume": { + "title": "Volume", "type": "string" }, - "uid": { - "title": "Unique ID", + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "KB Article", + "required": [ + "name", + "type_id" + ], + "title": "File", "type": "object" }, - "key_value_object": { + "remediation": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], "properties": { - "name": { - "title": "Name", - "type": "string" + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" }, - "value": { - "title": "Value", + "desc": { + "title": "Description", "type": "string" }, - "values": { + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { "items": { "type": "string" }, - "title": "Values", + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", "type": "array" } }, "required": [ - "name" + "desc" ], - "title": "Key:Value object", + "title": "Remediation", "type": "object" }, - "keyboard_info": { + "email": { "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" + "anyOf": [ + { + "required": [ + "from" + ] }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" + { + "required": [ + "to" + ] } - }, - "required": [ - "phase_id" ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, "properties": { - "cost_center": { - "title": "Cost Center", + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" }, - "department": { - "title": "Department", + "from": { + "title": "From", "type": "string" }, - "display_name": { - "title": "Display Name", + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", "type": "string" }, - "email_addrs": { + "from_mailboxes": { "items": { "type": "string" }, - "title": "Email Addresses", + "title": "From Mailboxes", "type": "array" }, - "employee_uid": { - "title": "Employee ID", - "type": "string" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "given_name": { - "title": "Given Name", + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", "type": "string" }, - "hire_time": { - "title": "Hire Time", - "type": "integer" + "raw_header": { + "title": "Raw Header", + "type": "string" }, - "job_title": { - "title": "Job Title", + "reply_to": { + "title": "Reply To", "type": "string" }, - "labels": { + "reply_to_list": { "items": { "type": "string" }, - "title": "Labels", + "title": "Reply To List", "type": "array" }, - "last_login_time": { - "title": "Last Login", - "type": "integer" + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" }, - "ldap_cn": { - "title": "LDAP Common Name", + "return_path": { + "title": "Return Path", "type": "string" }, - "ldap_dn": { - "title": "LDAP Distinguished Name", + "sender": { + "title": "Sender", "type": "string" }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" }, - "modified_time": { - "title": "Modified Time", + "size": { + "title": "Size", "type": "integer" }, - "office_location": { - "title": "Office Location", + "smtp_from": { + "title": "SMTP From", "type": "string" }, - "phone_number": { - "title": "Telephone Number", + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", "type": "string" }, - "surname": { - "title": "Surname", + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", "type": "string" }, - "tags": { + "urls": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/url" }, - "title": "Tags", + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", "type": "array" } }, - "title": "LDAP Person", + "title": "Email", "type": "object" }, - "location": { + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "city" + "name" ] }, { "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" + "uid" ] } ], "properties": { - "aerial_height": { - "title": "Aerial Height", + "name": { + "title": "Name", "type": "string" }, - "city": { - "title": "City", + "src_url": { + "title": "Source URL", "type": "string" }, - "continent": { - "title": "Continent", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", "type": "string" }, - "coordinates": { + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { "items": { - "type": "number" + "$ref": "#/$defs/http_header" }, - "title": "Coordinates", + "title": "HTTP Headers", "type": "array" }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", "type": "string" }, - "geohash": { - "title": "Geohash", - "type": "string" + "length": { + "title": "Request Length", + "type": "integer" }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", + "referrer": { + "title": "HTTP Referrer", "type": "string" }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "pressure_altitude": { - "title": "Pressure Altitude", + "user_agent": { + "title": "HTTP User-Agent", "type": "string" }, - "provider": { - "title": "Provider", + "version": { + "title": "HTTP Version", "type": "string" }, - "region": { - "title": "Region", - "type": "string" + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" } }, - "title": "Geo Location", + "title": "HTTP Request", "type": "object" }, - "logger": { + "cvss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "base_score": { + "title": "Base Score", + "type": "number" }, - "log_format": { - "title": "Log Format", + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", "type": "string" }, - "log_level": { - "title": "Log Level", - "type": "string" + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" }, - "log_name": { - "title": "Log Name", - "type": "string" + "overall_score": { + "title": "Overall Score", + "type": "number" }, - "log_provider": { - "title": "Log Provider", + "severity": { + "title": "Severity", "type": "string" }, - "log_version": { - "title": "Log Version", + "src_url": { + "title": "Source URL", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", + "vector_string": { + "title": "Vector String", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Logger", + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", "type": "object" }, - "long_string": { + "fingerprint": { "additionalProperties": false, "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "algorithm": { + "title": "Algorithm", + "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", "type": "integer" }, "value": { @@ -3815,111 +3867,69 @@ } }, "required": [ + "algorithm_id", "value" ], - "title": "Long String", + "title": "Fingerprint", "type": "object" }, - "malware": { + "process_entity": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "cmd_line" ] }, { "required": [ - "uid" + "cpid" ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" + { + "required": [ + "name" + ] }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" + { + "required": [ + "path" + ] }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" + { + "required": [ + "pid" + ] }, - "name": { - "title": "Name", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "provider": { - "title": "Provider", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", "type": "string" }, - "severity": { - "title": "Severity", + "path": { + "title": "Path", "type": "string" }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", + "pid": { + "title": "Process ID", "type": "integer" }, "uid": { @@ -3927,54 +3937,23 @@ "type": "string" } }, - "required": [ - "classification_ids" - ], - "title": "Malware", + "title": "Process Entity", "type": "object" }, - "malware_scan_info": { + "observable": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "end_time": { - "title": "End Time", - "type": "integer" + "event_uid": { + "title": "Event UID", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, "type": { "title": "Type", @@ -3990,277 +3969,230 @@ 5, 6, 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, 99 ], "title": "Type ID", "type": "integer" }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", + "type_uid": { + "title": "Type ID", "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" } }, "required": [ "type_id" ], - "title": "Malware Scan Info", + "title": "Observable", "type": "object" }, - "message_context": { + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { "additionalProperties": false, "anyOf": [ { "required": [ - "application" + "sub_technique" ] }, { "required": [ - "service" + "tactic" + ] + }, + { + "required": [ + "technique" ] } ], "properties": { - "ai_role": { - "title": "AI Role", - "type": "string" + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" }, - "ai_role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "AI Role ID", - "type": "integer" - }, - "application": { - "$ref": "#/$defs/application", - "title": "Application" - }, - "completion_tokens": { - "title": "Completion Tokens", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" }, - "prompt_tokens": { - "title": "Prompt Tokens", - "type": "integer" + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" }, - "total_tokens": { - "title": "Total Tokens", - "type": "integer" + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" }, - "uid": { - "title": "Unique ID", + "version": { + "title": "Version", "type": "string" } }, - "title": "Message Context", + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", "type": "object" }, - "metadata": { + "network_interface": { "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "log_name": { - "title": "Log Name", - "type": "string" + { + "required": [ + "ip" + ] }, - "log_provider": { - "title": "Log Provider", - "type": "string" + { + "required": [ + "mac" + ] }, - "log_source": { - "title": "Log Source", - "type": "string" + { + "required": [ + "name" + ] }, - "log_version": { - "title": "Log Version", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", + "ip": { + "title": "IP Address", "type": "string" }, - "original_time": { - "title": "Original Time", + "mac": { + "title": "MAC Address", "type": "string" }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", + "name": { + "title": "Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", + "namespace": { + "title": "Namespace", "type": "string" }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { + "open_ports": { "items": { - "$ref": "#/$defs/transformation_info" + "$ref": "#/$defs/port_info" }, - "title": "Transformation Info", + "title": "Open Ports", "type": "array" }, - "transmit_time": { - "title": "Transmission Time", + "subnet_prefix": { + "title": "Subnet Prefix Length", "type": "integer" }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "name", - "value" - ], - "title": "Metric", + "title": "Network Interface", "type": "object" }, - "mitigation": { + "user": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "account" + ] + }, { "required": [ "name" @@ -4273,203 +4205,132 @@ } ], "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "src_url": { - "title": "Source URL", + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "uid": { - "title": "Unique ID", + "display_name": { + "title": "Display Name", "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_endpoint": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" }, "domain": { "title": "Domain", "type": "string" }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", + "email_addr": { + "title": "Email Address", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "forward_addr": { + "title": "Forwarding Address", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "full_name": { + "title": "Full Name", "type": "string" }, - "intermediate_ips": { + "groups": { "items": { - "type": "string" + "$ref": "#/$defs/group" }, - "title": "Intermediate IP Addresses", + "title": "Groups", "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" }, - "isp": { - "title": "ISP Name", - "type": "string" + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" }, - "isp_org": { - "title": "ISP Org", + "name": { + "title": "Name", "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "mac_vendor": { - "title": "MAC Vendor", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" }, - "network_scope": { - "title": "Network Scope", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "network_scope_id": { + "risk_level_id": { "enum": [ 0, 1, 2, + 3, + 4, 99 ], - "title": "Network Scope ID", + "title": "Risk Level ID", "type": "integer" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "type": { + "title": "Type", + "type": "string" }, - "port": { - "title": "Port", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" + "uid": { + "title": "Unique ID", + "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "uid_alt": { + "title": "Alternate ID", "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "svc_name": { - "title": "Service Name", + "email_addr": { + "title": "Email Address", "type": "string" }, - "type": { - "title": "Type", + "factor_type": { + "title": "Factor Type", "type": "string" }, - "type_id": { + "factor_type_id": { "enum": [ 0, 1, @@ -4483,292 +4344,226 @@ 9, 10, 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "Factor Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" }, - "vpc_uid": { - "title": "VPC UID", + "phone_number": { + "title": "Phone Number", "type": "string" }, - "zone": { - "title": "Network Zone", + "provider": { + "title": "Provider", "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" } + }, + "required": [ + "factor_type_id" ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, "properties": { - "hostname": { - "title": "Hostname", + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", "type": "string" }, - "ip": { - "title": "IP Address", + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", "type": "string" }, - "mac": { - "title": "MAC Address", + "detection_pattern": { + "title": "Detection Pattern", "type": "string" }, - "name": { - "title": "Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "namespace": { - "title": "Namespace", + "category": { + "title": "Category", "type": "string" }, - "open_ports": { + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { "items": { - "$ref": "#/$defs/port_info" + "type": "string" }, - "title": "Open Ports", + "title": "Related Subdomains", "type": "array" }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, "type": { "title": "Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", + "uploaded_time": { + "title": "Uploaded Time", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "network_proxy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - { - "required": [ - "interface_name" - ] + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - { - "required": [ - "interface_uid" - ] + "comment": { + "title": "Analyst Comments", + "type": "string" }, - { - "required": [ - "ip" - ] + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - { - "required": [ - "name" - ] + "value": { + "title": "Indicator", + "type": "string" }, - { - "required": [ - "svc_name" - ] + "created_time": { + "title": "Created Time", + "type": "integer" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { + "intrusion_sets": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "Intrusion Sets", "type": "array" }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" }, - "domain": { - "title": "Domain", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "fingerprints": { + "attacks": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/attack" }, - "title": "Fingerprints", + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", "type": "array" }, - "hostname": { - "title": "Hostname", - "type": "string" + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "file": { + "$ref": "#/$defs/file", + "title": "Related File" }, - "instance_uid": { - "title": "Instance ID", - "type": "string" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "interface_name": { - "title": "Network Interface Name", + "name": { + "title": "Name", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" }, - "intermediate_ips": { + "kill_chain": { "items": { - "type": "string" + "$ref": "#/$defs/kill_chain_phase" }, - "title": "Intermediate IP Addresses", + "title": "Kill Chain", "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { + "detection_pattern_type_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", + "title": "Detection Pattern Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", + "detection_pattern_type": { + "title": "Detection Pattern", "type": "string" }, - "svc_name": { - "title": "Service Name", - "type": "string" + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" }, "type_id": { "enum": [ @@ -4787,42 +4582,91 @@ 12, 13, 14, - 15, 99 ], - "title": "Type ID", + "title": "Indicator Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "vlan_uid": { - "title": "VLAN", + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", "type": "string" }, - "vpc_uid": { - "title": "VPC UID", + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "zone": { - "title": "Network Zone", + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" } }, - "title": "Network Proxy Endpoint", + "required": [ + "type_id", + "value" + ], + "title": "OSINT", "type": "object" }, - "node": { + "san": { "additionalProperties": false, "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" @@ -4830,182 +4674,83 @@ "type": { "title": "Type", "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" } }, "required": [ - "uid" + "name", + "type" ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", + "title": "Subject Alternative Name", "type": "object" }, - "observable": { + "occurrence_details": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], "properties": { - "event_uid": { - "title": "Event UID", + "cell_name": { + "title": "Cell Name", "type": "string" }, - "name": { - "title": "Name", + "column_name": { + "title": "Column Name", "type": "string" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "column_number": { + "title": "Column Number", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", "type": "string" }, "page_number": { @@ -5028,7 +4773,7 @@ "title": "Occurrence Details", "type": "object" }, - "organization": { + "firewall_rule": { "additionalProperties": false, "anyOf": [ { @@ -5043,91 +4788,164 @@ } ], "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "ou_name": { - "title": "Org Unit Name", + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", "type": "string" }, - "ou_uid": { - "title": "Org Unit ID", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Organization", + "title": "Firewall Rule", "type": "object" }, - "os": { + "threat_actor": { "additionalProperties": false, "properties": { - "build": { - "title": "OS Build", + "name": { + "title": "Name", "type": "string" }, - "country": { - "title": "Country", + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", "type": "string" }, "cpe_name": { "title": "The product CPE identifier", "type": "string" }, - "cpu_bits": { - "title": "CPU Bits", + "epoch": { + "title": "Epoch", "type": "integer" }, - "edition": { - "title": "OS Edition", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "kernel_release": { - "title": "Kernel Release", + "license": { + "title": "Software License", "type": "string" }, - "lang": { - "title": "Language", + "license_url": { + "title": "Software License URL", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "sp_name": { - "title": "OS Service Pack", + "package_manager": { + "title": "Package Manager", "type": "string" }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" }, - "type": { - "title": "Type", + "purl": { + "title": "Package URL", "type": "string" }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 ], "title": "Type ID", "type": "integer" }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, "version": { "title": "Version", "type": "string" @@ -5135,184 +4953,349 @@ }, "required": [ "name", - "type_id" + "version" ], - "title": "Operating System (OS)", + "title": "Software Package", "type": "object" }, - "osint": { + "transformation_info": { "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "comment": { - "title": "Analyst Comments", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", "type": "string" }, - "confidence": { - "title": "Confidence", + "name": { + "title": "Name", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "created_time": { - "title": "Created Time", + "time": { + "title": "Event Time", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", + "uid": { + "title": "Unique ID", "type": "string" }, - "detection_pattern_type": { - "title": "Detection Pattern", + "url_string": { + "title": "URL String", "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", "type": "integer" }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "data": { + "title": "Data" }, - "external_uid": { - "title": "External ID", + "error": { + "title": "Error Code", "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" + "error_message": { + "title": "Error Message", + "type": "string" }, - "intrusion_sets": { + "flags": { "items": { "type": "string" }, - "title": "Intrusion Sets", + "title": "Flags", "type": "array" }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + { + "required": [ + "ip" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "name" + ] }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "ip": { + "title": "IP Address", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "risk_score": { - "title": "Risk Score", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" + }, + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "port": { + "title": "Port", "type": "integer" }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" + "query_string": { + "title": "HTTP Query String", + "type": "string" }, - "severity": { - "title": "Severity", + "resource_type": { + "title": "Resource Type", "type": "string" }, - "severity_id": { + "scheme": { + "title": "Scheme", + "type": "string" + }, + "subdomain": { + "title": "Subdomain", + "type": "string" + }, + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Uniform Resource Locator", + "type": "object" + }, + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", + "type": "string" + }, + "bus_type_id": { "enum": [ 0, 1, @@ -5321,445 +5304,555 @@ 4, 5, 6, + 7, 99 ], - "title": "Severity ID", + "title": "Bus Type ID", "type": "integer" }, - "signatures": { + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" + }, + "protocol_name": { + "title": "Protocol Name", + "type": "string" + }, + "protocol_num": { + "title": "Protocol Number", + "type": "integer" + } + }, + "required": [ + "port" + ], + "title": "Port Information", + "type": "object" + }, + "service": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "flags": { "items": { - "$ref": "#/$defs/digital_signature" + "type": "string" }, - "title": "Related Digital Signatures", + "title": "Flags", "type": "array" }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "Request Elements", + "type": "object" + }, + "sub_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, "src_url": { "title": "Source URL", "type": "string" }, - "subdomains": { + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { "items": { "type": "string" }, - "title": "Related Subdomains", + "title": "Labels", "type": "array" }, - "subnet": { - "title": "Related Subnet", + "name": { + "title": "Name", "type": "string" }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", + "network_driver": { + "title": "Network Driver", "type": "string" }, - "type": { - "title": "Type", + "orchestrator": { + "title": "Orchestrator", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" + "pod_uuid": { + "title": "Pod UUID", + "type": "string" }, - "uid": { - "title": "Unique ID", + "runtime": { + "title": "Runtime", "type": "string" }, - "uploaded_time": { - "title": "Uploaded Time", + "size": { + "title": "Size", "type": "integer" }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", + "tag": { + "title": "Image Tag", "type": "string" }, - "vulnerabilities": { + "tags": { "items": { - "$ref": "#/$defs/vulnerability" + "$ref": "#/$defs/key_value_object" }, - "title": "Related Vulnerabilities", + "title": "Tags", "type": "array" }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" + "uid": { + "title": "Unique ID", + "type": "string" } }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", + "title": "Container", "type": "object" }, - "package": { + "malware": { "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "epoch": { - "title": "Epoch", - "type": "integer" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" }, - "license": { - "title": "Software License", - "type": "string" + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" }, - "license_url": { - "title": "Software License URL", - "type": "string" + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" }, - "release": { - "title": "Software Release Details", + "path": { + "title": "Path", "type": "string" - }, - "src_url": { - "title": "Source URL", + }, + "provider": { + "title": "Provider", "type": "string" }, - "type": { - "title": "Type", + "severity": { + "title": "Severity", "type": "string" }, - "type_id": { + "severity_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Type ID", + "title": "Severity ID", "type": "integer" }, "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", + "title": "Unique ID", "type": "string" } }, "required": [ - "name", - "version" + "classification_ids" ], - "title": "Software Package", + "title": "Malware", "type": "object" }, - "policy": { + "win_win_service": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "cmd_line" ] }, { "required": [ - "type" + "service_category_id" ] }, { "required": [ - "uid" + "service_dependencies" ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" + { + "required": [ + "service_error_control_id" + ] }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ { "required": [ - "cpid" + "service_start_name" ] }, { "required": [ - "pid" + "service_start_type_id" ] }, { "required": [ - "uid" + "service_type_id" ] } ], "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, "cmd_line": { "title": "Command Line", "type": "string" }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" }, - "environment_variables": { + "labels": { "items": { - "$ref": "#/$defs/environment_variable" + "type": "string" }, - "title": "Environment Variables", + "title": "Labels", "type": "array" }, - "file": { - "$ref": "#/$defs/file", - "title": "File" + "load_order_group": { + "title": "Load Order Group", + "type": "string" }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "integrity": { - "title": "Integrity", + "service_category": { + "title": "Service Category", "type": "string" }, - "integrity_id": { + "service_category_id": { "enum": [ 0, 1, 2, - 3, - 4, - 5, - 6, 99 ], - "title": "Integrity Level", + "title": "Service Category ID", "type": "integer" }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { + "service_dependencies": { "items": { "type": "string" }, - "title": "Loaded Modules", + "title": "Service Dependencies", "type": "array" }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" }, - "path": { - "title": "Path", + "service_error_control": { + "title": "Service Error Control", "type": "string" }, - "pid": { - "title": "Process ID", + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", "type": "integer" }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" }, - "sandbox": { - "title": "Sandbox", + "service_start_name": { + "title": "Service Start Name", "type": "string" }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" + "service_start_type": { + "title": "Service Start Type", + "type": "string" }, - "tid": { - "title": "Thread ID", + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", + "service_type": { + "title": "Service Type", "type": "string" }, - "user": { - "$ref": "#/$defs/user", - "title": "User" + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" }, - "working_directory": { - "title": "Working Directory", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", "type": "string" }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" + "version": { + "title": "Version", + "type": "string" } }, - "title": "Process", + "required": [ + "name" + ], + "title": "Windows Service", "type": "object" }, - "process_entity": { + "group": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, { "required": [ "name" ] }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, { "required": [ "uid" @@ -5767,41 +5860,69 @@ } ], "properties": { - "cmd_line": { - "title": "Command Line", + "desc": { + "title": "Description", "type": "string" }, - "cpid": { - "title": "Common Process Identifier", + "domain": { + "title": "Domain", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", - "type": "string" + "privileges": { + "items": { + "type": "string" + }, + "title": "Privileges", + "type": "array" }, - "pid": { - "title": "Process ID", - "type": "integer" + "type": { + "title": "Group Type", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "title": "Process Entity", + "title": "Group", "type": "object" }, - "product": { + "device": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" @@ -5814,175 +5935,153 @@ } ], "properties": { - "cpe_name": { - "title": "The product CPE identifier", + "region": { + "title": "Region", "type": "string" }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "name": { - "title": "Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "path": { - "title": "Path", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "modified_time": { + "title": "Modified Time", + "type": "integer" }, - "url_string": { - "title": "URL String", + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "os_machine_uuid": { + "title": "OS Machine UUID", "type": "string" }, - "version": { - "title": "Version", + "hypervisor": { + "title": "Hypervisor", "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "desc": { - "title": "Description", + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "first_seen_time": { + "title": "First Seen", + "type": "integer" }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "mac": { + "title": "MAC Address", + "type": "string" }, - "references": { + "imei_list": { "items": { "type": "string" }, - "title": "References", + "title": "IMEI List", "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] }, - { - "required": [ - "ip" - ] + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - { - "required": [ - "name" - ] + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", "type": "string" }, - "ip": { - "title": "IP Address", + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", "type": "string" }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, "name": { "title": "Name", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "uid": { - "title": "Unique ID", + "iccid": { + "title": "ICCID", "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" }, - "provider": { - "title": "Provider", + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "score": { - "title": "Reputation Score", + "udid": { + "title": "Unique Device Identifier", "type": "string" }, - "score_id": { + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, @@ -5995,65 +6094,87 @@ 8, 9, 10, + 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Reputation Score ID", + "title": "Type ID", "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" }, - "data": { - "title": "Data" + "last_seen_time": { + "title": "Last Seen", + "type": "integer" }, - "flags": { + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "boot_time": { + "title": "Boot Time", + "type": "integer" + }, + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" + }, + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { "items": { - "type": "string" + "$ref": "#/$defs/network_interface" }, - "title": "Flags", + "title": "Network Interfaces", "type": "array" }, - "uid": { - "title": "Unique ID", + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "subnet": { + "title": "Subnet", + "type": "string" + }, + "eid": { + "title": "EID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "resource_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { "agent_list": { "items": { "$ref": "#/$defs/agent" @@ -6061,65 +6182,81 @@ "title": "Agent List", "type": "array" }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "criticality": { - "title": "Criticality", + "ip": { + "title": "IP Address", "type": "string" }, - "data": { - "title": "Data" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, "hostname": { "title": "Hostname", "type": "string" }, - "ip": { - "title": "IP Address", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", + "is_mobile_account_active": { + "title": "Mobile Account Active", "type": "boolean" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" }, + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Device", + "type": "object" + }, + "campaign": { + "additionalProperties": false, + "properties": { "name": { "title": "Name", "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" - }, - "role": { - "title": "Role", + "src_url": { + "title": "Source URL", "type": "string" }, - "role_id": { + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { "enum": [ 0, 1, @@ -6128,77 +6265,108 @@ 4, 99 ], - "title": "Role ID", + "title": "Algorithm ID", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" }, - "type": { - "title": "Type", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "developer_uid": { + "title": "Developer UID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" }, - "version": { - "title": "Version", + "state": { + "title": "State", "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" } }, - "title": "Resource Details", + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", "type": "object" }, - "response": { + "sbom": { "additionalProperties": false, "properties": { - "code": { - "title": "Response Code", + "created_time": { + "title": "Created Time", "type": "integer" }, - "containers": { + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { "items": { - "$ref": "#/$defs/container" + "$ref": "#/$defs/software_component" }, - "title": "Containers", + "title": "Software Components", "type": "array" }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", + "type": { + "title": "Type", "type": "string" }, - "error_message": { - "title": "Error Message", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" + "uid": { + "title": "SBOM ID", + "type": "string" }, - "message": { - "title": "Message", + "version": { + "title": "Version", "type": "string" } }, - "title": "Response Elements", + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", "type": "object" }, - "rule": { + "malware_scan_info": { "additionalProperties": false, "anyOf": [ { @@ -6213,114 +6381,140 @@ } ], "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" + "end_time": { + "title": "End Time", + "type": "integer" }, "name": { "title": "Name", "type": "string" }, + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, "type": { "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, "uid": { - "title": "Unique ID", + "title": "Scan UID", "type": "string" }, - "version": { - "title": "Version", - "type": "string" + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" } }, - "title": "Rule", + "required": [ + "type_id" + ], + "title": "Malware Scan Info", "type": "object" }, - "san": { + "kill_chain_phase": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", + "phase": { + "title": "Kill Chain Phase", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", + "type": "integer" } }, "required": [ - "name", - "type" + "phase_id" ], - "title": "Subject Alternative Name", + "title": "Kill Chain Phase", "type": "object" }, - "sbom": { + "organization": { "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "package": { - "$ref": "#/$defs/package", - "title": "Software Package" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "software_components": { - "items": { - "$ref": "#/$defs/software_component" - }, - "title": "Software Components", - "type": "array" + "anyOf": [ + { + "required": [ + "name" + ] }, - "type": { - "title": "Type", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", - "type": "integer" + "ou_name": { + "title": "Org Unit Name", + "type": "string" }, - "uid": { - "title": "SBOM ID", + "ou_uid": { + "title": "Org Unit ID", "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "package", - "software_components" - ], - "title": "Software Bill of Materials", + "title": "Organization", "type": "object" }, - "scim": { + "encryption_details": { "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "algorithm": { + "title": "Encryption Algorithm", "type": "string" }, - "auth_protocol_id": { + "algorithm_id": { "enum": [ 0, 1, @@ -6329,127 +6523,234 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", + "title": "Encryption Algorithm ID", "type": "integer" }, - "created_time": { - "title": "Created Time", + "key_length": { + "title": "Encryption Key Length", "type": "integer" }, - "error_message": { - "title": "Last Error Message", + "key_uid": { + "title": "Key UID", "type": "string" }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" + "event_uid": { + "title": "Event UID", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "name": { - "title": "Name", + "log_format": { + "title": "Log Format", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "log_level": { + "title": "Log Level", "type": "string" }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" + "log_name": { + "title": "Log Name", + "type": "string" }, - "scim_group_schema": { - "title": "SCIM Group Schema" + "log_provider": { + "title": "Log Provider", + "type": "string" }, - "scim_user_schema": { - "title": "SCIM User Schema" + "log_version": { + "title": "Log Version", + "type": "string" }, - "state": { - "title": "State", + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", "type": "string" }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "External ID", + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "url_string": { - "title": "SCIM Endpoint URL", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Service Provider", + "uid": { + "title": "Unique ID", "type": "string" }, "version": { - "title": "SCIM Version", + "title": "Version", "type": "string" } }, - "title": "SCIM", + "title": "Feature", "type": "object" }, - "script": { + "timespan": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "duration_days": { + "title": "Duration Days", + "type": "integer" + }, + "duration_hours": { + "title": "Duration Hours", + "type": "integer" }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "duration_months": { + "title": "Duration Months", + "type": "integer" }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" }, "type": { - "title": "Type", + "title": "Time Span Type", "type": "string" }, "type_id": { @@ -6462,24 +6763,18 @@ 5, 6, 7, + 8, + 9, 99 ], - "title": "Type ID", + "title": "Time Span Type ID", "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" } }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", + "title": "Time Span", "type": "object" }, - "service": { + "rule": { "additionalProperties": false, "anyOf": [ { @@ -6494,93 +6789,32 @@ } ], "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", + "category": { + "title": "Category", "type": "string" }, - "expiration_reason": { - "title": "Expiration Reason", + "desc": { + "title": "Description", "type": "string" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", + "name": { + "title": "Name", "type": "string" }, - "terminal": { - "title": "Terminal", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", + "version": { + "title": "Version", "type": "string" } }, - "title": "Session", + "title": "Rule", "type": "object" }, "software_component": { @@ -6650,62 +6884,37 @@ "title": "Software Component", "type": "object" }, - "span": { + "agent": { "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "uid": { - "title": "Unique ID", - "type": "string" + { + "required": [ + "uid" + ] } - }, - "required": [ - "end_time", - "start_time", - "uid" ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "name": { + "title": "Agent Name", "type": "string" }, - "auth_protocol_id": { + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, @@ -6717,84 +6926,128 @@ 7, 8, 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", + "title": "Type ID", "type": "integer" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, "created_time": { - "title": "Created Time", + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", "type": "integer" }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" + "domain": { + "title": "Domain", + "type": "string" }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" }, - "login_endpoint": { - "title": "SSO Login Endpoint", + "email_addr": { + "title": "Registrar Abuse Email Address", "type": "string" }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", + "isp": { + "title": "ISP Name", "type": "string" }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "modified_time": { - "title": "Modified Time", + "last_seen_time": { + "title": "Last Updated At", "type": "integer" }, - "name": { - "title": "Name", + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "registrar": { + "title": "Domain Registrar", "type": "string" }, - "scopes": { + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { "items": { "type": "string" }, - "title": "Scopes", + "title": "Subdomains", "type": "array" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", + "subnet": { + "title": "Subnet Block", "type": "string" } }, - "title": "SSO", + "title": "WHOIS", "type": "object" }, - "sub_technique": { + "key_value_object": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "value" ] }, { "required": [ - "uid" + "values" ] } ], @@ -6803,536 +7056,401 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "value": { + "title": "Value", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" } }, - "title": "MITRE Sub-technique", + "required": [ + "name" + ], + "title": "Key:Value object", "type": "object" }, - "tactic": { + "metadata": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "log_format": { + "title": "Log Source Format", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" }, "uid": { - "title": "Unique ID", + "title": "Event UID", "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" }, - "uid": { - "title": "Unique ID", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "MITRE Technique", + "required": [ + "product", + "version" + ], + "title": "Metadata", "type": "object" }, - "threat_actor": { + "node": { "additionalProperties": false, "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, "type": { - "title": "Threat Actor Type", + "title": "Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" + "uid": { + "title": "Unique ID", + "type": "string" } }, "required": [ - "name" + "uid" ], - "title": "Threat Actor", + "title": "Node", "type": "object" }, - "timespan": { + "product": { "additionalProperties": false, "anyOf": [ { "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" + "name" ] }, { "required": [ - "start_time" + "uid" ] } ], "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" }, - "duration_months": { - "title": "Duration Months", - "type": "integer" + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" + "lang": { + "title": "Language", + "type": "string" }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "duration_years": { - "title": "Duration Years", - "type": "integer" + "path": { + "title": "Path", + "type": "string" }, - "end_time": { - "title": "End Time", - "type": "integer" + "uid": { + "title": "Unique ID", + "type": "string" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "url_string": { + "title": "URL String", + "type": "string" }, - "type": { - "title": "Time Span Type", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" + "version": { + "title": "Version", + "type": "string" } }, - "title": "Time Span", + "title": "Product", "type": "object" }, - "token": { + "advisory": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "bulletin": { + "title": "Patch Bulletin", + "type": "string" }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" + "classification": { + "title": "Classification", + "type": "string" }, - "modified_time": { - "title": "Modified Time", + "created_time": { + "title": "Created Time", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", + "desc": { + "title": "Description", "type": "string" }, - "type": { - "title": "Type", + "install_state": { + "title": "Install State", "type": "string" }, - "type_id": { + "install_state_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, - 6, - 7, 99 ], - "title": "Type ID", + "title": "Install State ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" }, - "end_time": { - "title": "End Time", + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "flags": { + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { "items": { "type": "string" }, - "title": "Flags", + "title": "References", "type": "array" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" }, - "start_time": { - "title": "Start Time", + "size": { + "title": "Size", "type": "integer" }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "title": { + "title": "Title", + "type": "string" + }, "uid": { - "title": "Unique ID", + "title": "Advisory ID", "type": "string" } }, "required": [ "uid" ], - "title": "Trace", + "title": "Advisory", "type": "object" }, - "transformation_info": { + "network_endpoint": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "domain" ] }, { "required": [ - "uid" + "hostname" ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ { "required": [ - "path" + "instance_uid" ] }, { "required": [ - "url_string" + "interface_name" ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" }, - "subdomain": { - "title": "Subdomain", - "type": "string" + { + "required": [ + "interface_uid" + ] }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ { "required": [ - "account" + "ip" ] }, { @@ -7340,6 +7458,11 @@ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -7347,88 +7470,125 @@ } ], "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "display_name": { - "title": "Display Name", - "type": "string" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, "domain": { "title": "Domain", "type": "string" }, - "email_addr": { - "title": "Email Address", + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", "type": "string" }, - "forward_addr": { - "title": "Forwarding Address", + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "full_name": { - "title": "Full Name", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "groups": { + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { "items": { - "$ref": "#/$defs/group" + "type": "string" }, - "title": "Groups", + "title": "Intermediate IP Addresses", "type": "array" }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" + "ip": { + "title": "IP Address", + "type": "string" }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" + "isp": { + "title": "ISP Name", + "type": "string" }, - "name": { - "title": "Name", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "phone_number": { - "title": "Telephone Number", + "mac": { + "title": "MAC Address", "type": "string" }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "name": { + "title": "Name", "type": "string" }, - "risk_level_id": { + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { "enum": [ 0, 1, 2, - 3, - 4, 99 ], - "title": "Risk Level ID", + "title": "Network Scope ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", "type": "integer" }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, "type": { "title": "Type", "type": "string" @@ -7440,6 +7600,17 @@ 2, 3, 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, 99 ], "title": "Type ID", @@ -7449,161 +7620,94 @@ "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", "type": "string" } }, - "title": "User", + "title": "Network Endpoint", "type": "object" }, - "vulnerability": { + "d3f_tactic": { "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, + "anyOf": [ { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, "required": [ - "cve" + "name" ] }, { - "not": { - "required": [ - "advisory", - "cve" - ] - }, "required": [ - "cwe" + "uid" ] } ], "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", + "name": { + "title": "Name", "type": "string" }, - "exploit_type": { - "title": "Exploit Type", + "src_url": { + "title": "Source URL", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", + "uid": { + "title": "Unique ID", "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", "type": "integer" }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { + "cvss": { "items": { - "$ref": "#/$defs/kb_article" + "$ref": "#/$defs/cvss" }, - "title": "Knowledgebase Articles", + "title": "CVSS Score", "type": "array" }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" }, - "last_seen_time": { - "title": "Last Seen", + "cwe_uid": { + "title": "CWE UID", + "type": "string" + }, + "cwe_url": { + "title": "CWE URL", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, "references": { "items": { @@ -7612,284 +7716,180 @@ "title": "References", "type": "array" }, - "related_vulnerabilities": { + "related_cwes": { "items": { - "type": "string" + "$ref": "#/$defs/cwe" }, - "title": "Related Vulnerability IDs", + "title": "Related CWEs", "type": "array" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, "title": { "title": "Title", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", "type": "string" } }, - "title": "Vulnerability Details", + "required": [ + "uid" + ], + "title": "CVE", "type": "object" }, - "whois": { + "domain_contact": { "additionalProperties": false, "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, "email_addr": { - "title": "Registrar Abuse Email Address", + "title": "Contact Email", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" }, - "isp_org": { - "title": "ISP Org", + "name": { + "title": "Name", "type": "string" }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", + "title": "Phone Number", "type": "string" }, - "status": { - "title": "Domain Status", + "type": { + "title": "Domain Contact Type", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" }, - "subnet": { - "title": "Subnet Block", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "WHOIS", + "required": [ + "type_id" + ], + "title": "Domain Contact", "type": "object" }, - "win_win_service": { + "policy": { "additionalProperties": false, "anyOf": [ { "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" + "name" ] }, { "required": [ - "service_start_type_id" + "type" ] }, { "required": [ - "service_type_id" + "uid" ] } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" + "data": { + "title": "Data" }, - "name": { - "title": "Name", + "desc": { + "title": "Description", "type": "string" }, - "service_category": { - "title": "Service Category", - "type": "string" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" + "is_applied": { + "title": "Applied", + "type": "boolean" }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" + "type": { + "title": "Type", + "type": "string" }, - "service_error_control": { - "title": "Service Error Control", + "uid": { + "title": "Unique ID", "type": "string" }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" + "end_time": { + "title": "End Time", + "type": "integer" }, - "service_start_name": { - "title": "Service Start Name", + "message": { + "title": "Message", "type": "string" }, - "service_start_type": { - "title": "Service Start Type", + "operation": { + "title": "Operation", "type": "string" }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "status_code": { + "title": "Status Code", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "name" + "end_time", + "start_time", + "uid" ], - "title": "Windows Service", + "title": "Span", "type": "object" } }, @@ -7897,159 +7897,176 @@ "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { - "action": { - "title": "Action", + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" + }, + "message": { + "title": "Message", "type": "string" }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Activity ID", + "disposition": { + "title": "Disposition", + "type": "string" + }, + "category_uid": { + "const": 6, + "title": "Category ID", "type": "integer" }, - "activity_name": { - "title": "Activity", + "action": { + "title": "Action", "type": "string" }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "ai_model": { - "$ref": "#/$defs/ai_model", - "title": "AI Model" + "confidence": { + "title": "Confidence", + "type": "string" }, "api": { "$ref": "#/$defs/api", "title": "API Details" }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" }, - "category_name": { - "title": "Category", + "risk_details": { + "title": "Risk Details", "type": "string" }, - "category_uid": { - "const": 6, - "title": "Category ID", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "class_name": { - "title": "Class", + "status_detail": { + "title": "Status Detail", "type": "string" }, - "class_uid": { - "const": 6003, - "title": "Class ID", + "confidence_score": { + "title": "Confidence Score", "type": "integer" }, - "confidence": { - "title": "Confidence", + "status_code": { + "title": "Status Code", "type": "string" }, - "confidence_id": { + "disposition_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, 99 ], - "title": "Confidence ID", + "title": "Disposition ID", "type": "integer" }, - "confidence_score": { - "title": "Confidence Score", + "type_name": { + "title": "Type Name", + "type": "string" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", "type": "integer" }, - "count": { - "title": "Count", + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", "type": "integer" }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" }, - "disposition": { - "title": "Disposition", + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "status": { + "title": "Status", "type": "string" }, - "disposition_id": { + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "activity_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, 99 ], - "title": "Disposition ID", + "title": "Activity ID", "type": "integer" }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "duration": { - "title": "Duration Milliseconds", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "end_time": { - "title": "End Time", - "type": "integer" + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" }, "enrichments": { "items": { @@ -8058,170 +8075,153 @@ "title": "Enrichments", "type": "array" }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, "http_request": { "$ref": "#/$defs/http_request", "title": "HTTP Request" }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" - }, - "is_alert": { - "title": "Alert", - "type": "boolean" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "message_context": { - "$ref": "#/$defs/message_context", - "title": "Message Context" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "observables": { + "authorizations": { "items": { - "$ref": "#/$defs/observable" + "$ref": "#/$defs/authorization" }, - "title": "Observables", + "title": "Authorization Information", "type": "array" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, "raw_data_hash": { "$ref": "#/$defs/fingerprint", "title": "Raw Data Hash" }, - "raw_data_size": { - "title": "Raw Data Size", + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", "type": "integer" }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Resources Array", - "type": "array" - }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { + "confidence_id": { "enum": [ 0, 1, 2, 3, - 4, 99 ], - "title": "Risk Level ID", + "title": "Confidence ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", "type": "integer" }, - "severity": { - "title": "Severity", + "activity_name": { + "title": "Activity", "type": "string" }, - "severity_id": { + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Severity ID", + "title": "Risk Level ID", "type": "integer" }, - "src_endpoint": { + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "dst_endpoint": { "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" + "title": "Destination Endpoint" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "is_alert": { + "title": "Alert", + "type": "boolean" }, - "status": { - "title": "Status", - "type": "string" + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "status_code": { - "title": "Status Code", + "severity": { + "title": "Severity", "type": "string" }, - "status_detail": { - "title": "Status Detail", + "category_name": { + "title": "Category", "type": "string" }, - "status_id": { + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "severity_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Status ID", + "title": "Severity ID", "type": "integer" }, - "time": { - "title": "Event Time", + "count": { + "title": "Count", "type": "integer" }, - "timezone_offset": { - "title": "Timezone Offset", + "end_time": { + "title": "End Time", "type": "integer" }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, "type_uid": { "title": "Type ID", "type": "integer" }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" } }, "required": [ diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json index 396b82bfe1..ee9a0d4e14 100644 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@ai_operation+host+trace.json @@ -1,11 +1,11 @@ { "$defs": { - "account": { + "kb_article": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "src_url" ] }, { @@ -14,152 +14,6 @@ ] } ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, "properties": { "avg_timespan": { "$ref": "#/$defs/timespan", @@ -177,10 +31,6 @@ "title": "Created Time", "type": "integer" }, - "desc": { - "title": "Description", - "type": "string" - }, "install_state": { "title": "Install State", "type": "string" @@ -200,10 +50,6 @@ "title": "The patch is superseded.", "type": "boolean" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "os": { "$ref": "#/$defs/os", "title": "OS" @@ -212,26 +58,9 @@ "$ref": "#/$defs/product", "title": "Product" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, "size": { "title": "Size", @@ -246,247 +75,238 @@ "type": "string" }, "uid": { - "title": "Advisory ID", + "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Advisory", + "title": "KB Article", "type": "object" }, - "affected_code": { + "long_string": { "additionalProperties": false, "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "start_column": { - "title": "Start Column", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "file" + "value" ], - "title": "Affected Code", + "title": "Long String", "type": "object" }, - "affected_package": { + "enrichment": { "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpe_name": { - "title": "The product CPE identifier", + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "fixed_in_version": { - "title": "Fixed In Version", + "provider": { + "title": "Provider", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "license": { - "title": "Software License", + "short_desc": { + "title": "Short Description", "type": "string" }, - "license_url": { - "title": "Software License URL", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "type": { + "title": "Type", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", "type": "string" }, - "path": { - "title": "Path", + "display_name": { + "title": "Display Name", "type": "string" }, - "purl": { - "title": "Package URL", + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", "type": "string" }, - "release": { - "title": "Software Release Details", + "given_name": { + "title": "Given Name", "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "hire_time": { + "title": "Hire Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "job_title": { + "title": "Job Title", "type": "string" }, - "type": { - "title": "Type", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", "type": "integer" }, - "uid": { - "title": "Package UID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "version": { - "title": "Version", + "surname": { + "title": "Surname", "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" } }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", + "title": "LDAP Person", "type": "object" }, - "agent": { + "email_auth": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Agent Name", + "dkim": { + "title": "DKIM Status", "type": "string" }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", + "dkim_domain": { + "title": "DKIM Domain", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" }, - "uid": { - "title": "Agent ID", + "dmarc": { + "title": "DMARC Status", "type": "string" }, - "uid_alt": { - "title": "Alternate Agent ID", + "dmarc_override": { + "title": "DMARC Override", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "dmarc_policy": { + "title": "DMARC Policy", "type": "string" }, - "version": { - "title": "Agent Version", + "spf": { + "title": "SPF Status", "type": "string" } }, - "title": "Agent", + "title": "Email Authentication", "type": "object" }, - "ai_model": { + "epss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "ai_provider": { - "title": "AI Provider", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "percentile": { + "title": "EPSS Percentile", + "type": "number" }, - "uid": { - "title": "Unique ID", + "score": { + "title": "EPPS Score", "type": "string" }, "version": { @@ -495,54 +315,35 @@ } }, "required": [ - "ai_provider" + "score" ], - "title": "AI Model", + "title": "EPSS", "type": "object" }, - "analytic": { + "device_hw_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", + "bios_manufacturer": { + "title": "BIOS Manufacturer", "type": "string" }, - "desc": { - "title": "Description", + "bios_ver": { + "title": "BIOS Version", "type": "string" }, - "name": { - "title": "Name", + "chassis": { + "title": "Chassis", "type": "string" }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", + "cpu_architecture": { + "title": "CPU Architecture", "type": "string" }, - "state_id": { + "cpu_architecture_id": { "enum": [ 0, 1, @@ -550,93 +351,111 @@ 3, 99 ], - "title": "State ID", + "title": "CPU Architecture ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", + "cpu_cores": { + "title": "CPU Cores", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "cpu_count": { + "title": "CPU Count", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" }, - "operation": { - "title": "Operation", + "cpu_type": { + "title": "Processor Type", "type": "string" }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" + "gpu_count": { + "title": "GPU Count", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" }, - "version": { - "title": "Version", + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "required": [ - "operation" - ], - "title": "API", + "title": "Device Hardware Info", "type": "object" }, - "application": { + "network_proxy": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -644,166 +463,130 @@ } ], "properties": { - "criticality": { - "title": "Business Criticality", - "type": "string" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "data": { - "title": "Data" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "desc": { - "title": "Application Description", + "domain": { + "title": "Domain", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" }, "hostname": { "title": "Hostname", "type": "string" }, - "labels": { + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { "items": { "type": "string" }, - "title": "Labels", + "title": "Intermediate IP Addresses", "type": "array" }, - "name": { - "title": "Application Name", + "ip": { + "title": "IP Address", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Application Relationship" + "isp": { + "title": "ISP Name", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "sbom": { - "$ref": "#/$defs/sbom", - "title": "Related SBOM" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Application Type", + "mac": { + "title": "MAC Address", "type": "string" }, - "uid": { - "title": "Application ID", + "mac_vendor": { + "title": "MAC Vendor", "type": "string" }, - "uid_alt": { - "title": "Application Alternative ID", + "name": { + "title": "Name", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Application Version", + "network_scope": { + "title": "Network Scope", "type": "string" - } - }, - "title": "Application", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] }, - { - "required": [ - "tactic" - ] + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" + "port": { + "title": "Port", + "type": "integer" }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" }, - "version": { - "title": "Version", + "subnet_uid": { + "title": "Subnet UID", "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" }, - "email_addr": { - "title": "Email Address", + "svc_name": { + "title": "Service Name", "type": "string" }, - "factor_type": { - "title": "Factor Type", + "type": { + "title": "Type", "type": "string" }, - "factor_type_id": { + "type_id": { "enum": [ 0, 1, @@ -817,237 +600,189 @@ 9, 10, 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Factor Type ID", + "title": "Type ID", "type": "integer" }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", + "uid": { + "title": "Unique ID", "type": "string" }, - "provider": { - "title": "Provider", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Authorization Result", + "title": "Network Proxy Endpoint", "type": "object" }, - "autonomous_system": { + "data_classification": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "category_id" ] }, { "required": [ - "number" + "confidentiality_id" ] } ], "properties": { - "name": { - "title": "Name", + "category": { + "title": "Category", "type": "string" }, - "number": { - "title": "Number", + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" }, - "expiration_time": { - "title": "Expiration Time", + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", "type": "integer" }, - "fingerprints": { + "discovery_details": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/discovery_details" }, - "title": "Fingerprints", + "title": "Discovery Details", "type": "array" }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" + "size": { + "title": "Size", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", + "status": { + "title": "Status", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "total": { + "title": "Total", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" } }, - "required": [ - "type" - ], - "title": "Classifier Details", + "title": "Data Classification", "type": "object" }, - "cloud": { + "http_response": { "additionalProperties": false, "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" + "body_length": { + "title": "Response Body Length", + "type": "integer" }, - "cloud_partition": { - "title": "Cloud Partition", + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "project_uid": { - "title": "Project ID", - "type": "string" + "latency": { + "title": "Latency", + "type": "integer" }, - "provider": { - "title": "Cloud Provider", - "type": "string" + "length": { + "title": "Response Length", + "type": "integer" }, - "region": { - "title": "Region", + "message": { + "title": "Message", "type": "string" }, - "zone": { - "title": "Cloud Availability Zone", + "status": { + "title": "Status", "type": "string" } }, "required": [ - "provider" + "code" ], - "title": "Cloud", + "title": "HTTP Response", "type": "object" }, - "container": { + "resource_details": { "additionalProperties": false, "anyOf": [ { @@ -1062,13 +797,39 @@ } ], "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" }, "labels": { "items": { @@ -1077,34 +838,42 @@ "title": "Labels", "type": "array" }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "network_driver": { - "title": "Network Driver", + "namespace": { + "title": "Namespace", "type": "string" }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" }, - "runtime": { - "title": "Runtime", + "role": { + "title": "Role", "type": "string" }, - "size": { - "title": "Size", + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", "type": "integer" }, - "tag": { - "title": "Image Tag", - "type": "string" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -1112,167 +881,262 @@ "title": "Tags", "type": "array" }, + "type": { + "title": "Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Container", + "title": "Resource Details", "type": "object" }, - "cve": { + "display": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "color_depth": { + "title": "Color Depth", "type": "integer" }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" + "physical_height": { + "title": "Physical Height", + "type": "integer" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" + "physical_width": { + "title": "Physical Width", + "type": "integer" }, - "cwe_url": { - "title": "CWE URL", + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "desc": { - "title": "Description", + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", "type": "string" }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "name": { + "title": "Name", + "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "protocol_name": { + "title": "Supported Protocol", + "type": "string" }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "rate_limit": { + "title": "Rate Limit", + "type": "integer" }, - "title": { - "title": "Title", + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" }, "type": { - "title": "Vulnerability Type", + "title": "Type", "type": "string" }, "uid": { - "title": "CVE ID", + "title": "Unique ID", "type": "string" } }, "required": [ "uid" ], - "title": "CVE", + "title": "Programmatic Credential", "type": "object" }, - "cvss": { + "os": { "additionalProperties": false, "properties": { - "base_score": { - "title": "Base Score", - "type": "number" + "build": { + "title": "OS Build", + "type": "string" }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", + "country": { + "title": "Country", "type": "string" }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" }, - "overall_score": { - "title": "Overall Score", - "type": "number" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "severity": { - "title": "Severity", + "edition": { + "title": "OS Edition", "type": "string" }, - "src_url": { - "title": "Source URL", + "kernel_release": { + "title": "Kernel Release", "type": "string" }, - "vector_string": { - "title": "Vector String", + "lang": { + "title": "Language", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "name": { + "title": "Name", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", + "sp_name": { + "title": "OS Service Pack", "type": "string" }, - "src_url": { - "title": "Source URL", + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "uid": { - "title": "CWE ID", + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, "required": [ - "uid" + "name", + "type_id" ], - "title": "CWE", + "title": "Operating System (OS)", "type": "object" }, - "d3f_tactic": { + "tactic": { "additionalProperties": false, "anyOf": [ { @@ -1300,91 +1164,101 @@ "type": "string" } }, - "title": "MITRE D3FEND\u2122 Tactic", + "title": "MITRE Tactic", "type": "object" }, - "d3f_technique": { + "dns_answer": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "class": { + "title": "Resource Record Class", "type": "string" }, - "src_url": { - "title": "Source URL", + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", "type": "string" }, - "uid": { - "title": "Unique ID", + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", "type": "string" } }, - "title": "MITRE D3FEND\u2122 Technique", + "required": [ + "rdata" + ], + "title": "DNS Answer", "type": "object" }, - "d3fend": { + "discovery_details": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" + "count": { + "title": "Count", + "type": "integer" }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" }, - "version": { - "title": "Version", + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", "type": "string" } }, - "title": "MITRE D3FEND\u2122", + "title": "Discovery Details", "type": "object" }, - "data_classification": { + "sso": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], "properties": { - "category": { - "title": "Category", + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "category_id": { + "auth_protocol_id": { "enum": [ 0, 1, @@ -1393,114 +1267,247 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, 99 ], - "title": "Category ID", + "title": "Auth Protocol ID", "type": "integer" }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "duration_mins": { + "title": "SSO Session Duration", "type": "integer" }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" }, - "size": { - "title": "Size", + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "src_url": { - "title": "Source URL", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "status_details": { + "scopes": { "items": { "type": "string" }, - "title": "Status Details", + "title": "Scopes", "type": "array" }, - "status_id": { + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Data Classification", + "title": "Token", "type": "object" }, - "device": { + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "d3f_tactic" ] }, { "required": [ - "instance_uid" + "d3f_technique" ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" }, - { - "required": [ - "interface_name" - ] + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" }, - { - "required": [ - "interface_uid" - ] + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" }, - { - "required": [ - "ip" - ] + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ { "required": [ "name" @@ -1513,199 +1520,192 @@ } ], "properties": { - "agent_list": { + "countermeasures": { "items": { - "$ref": "#/$defs/agent" + "$ref": "#/$defs/d3fend" }, - "title": "Agent List", + "title": "Countermeasures", "type": "array" }, - "autoscale_uid": { - "title": "Autoscale UID", + "name": { + "title": "Name", "type": "string" }, - "boot_time": { - "title": "Boot Time", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "boot_uid": { - "title": "Boot UID", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] }, - "created_time": { - "title": "Created Time", - "type": "integer" + { + "required": [ + "country" + ] }, - "desc": { - "title": "Description", - "type": "string" + { + "required": [ + "postal_code" + ] }, - "domain": { - "title": "Domain", + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", "type": "string" }, - "eid": { - "title": "EID", + "city": { + "title": "City", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" + "continent": { + "title": "Continent", + "type": "string" }, - "groups": { + "coordinates": { "items": { - "$ref": "#/$defs/group" + "type": "number" }, - "title": "Groups", + "title": "Coordinates", "type": "array" }, - "hostname": { - "title": "Hostname", + "country": { + "title": "Country", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "desc": { + "title": "Description", + "type": "string" }, - "hypervisor": { - "title": "Hypervisor", + "geodetic_altitude": { + "title": "Geodetic Altitude", "type": "string" }, - "iccid": { - "title": "ICCID", + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", "type": "string" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "geohash": { + "title": "Geohash", + "type": "string" }, - "imei": { - "title": "IMEI", + "horizontal_accuracy": { + "title": "Horizontal Accuracy", "type": "string" }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" }, - "instance_uid": { - "title": "Instance ID", + "isp": { + "title": "ISP Name", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" + "lat": { + "title": "Latitude", + "type": "number" }, - "interface_uid": { - "title": "Network Interface ID", + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", "type": "string" }, - "ip": { - "title": "IP Address", + "pressure_altitude": { + "title": "Pressure Altitude", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" + "provider": { + "title": "Provider", + "type": "string" }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" }, - "mac": { - "title": "MAC Address", + "domain": { + "title": "Domain", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" }, - "meid": { - "title": "MEID", - "type": "string" + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" }, - "model": { - "title": "Model", + "issuer": { + "title": "Issuer Details", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" }, - "region": { - "title": "Region", - "type": "string" + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" }, - "risk_level": { - "title": "Risk Level", + "state": { + "title": "State", "type": "string" }, - "risk_level_id": { + "state_id": { "enum": [ 0, 1, @@ -1714,26 +1714,45 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "subnet": { - "title": "Subnet", + "uid": { + "title": "Unique ID", "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "url_string": { + "title": "Configuration URL", "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] }, - "type": { - "title": "Type", + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", "type": "string" }, - "type_id": { + "ai_role_id": { "enum": [ 0, 1, @@ -1742,371 +1761,497 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "AI Role ID", "type": "integer" }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" + "application": { + "$ref": "#/$defs/application", + "title": "Application" }, - "uid": { - "title": "Unique ID", - "type": "string" + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" }, - "uid_alt": { - "title": "Alternate ID", + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "total_tokens": { + "title": "Total Tokens", + "type": "integer" }, - "zone": { - "title": "Network Zone", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Device", + "title": "Message Context", "type": "object" }, - "device_hw_info": { + "process": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "bios_ver": { - "title": "BIOS Version", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "chassis": { - "title": "Chassis", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpu_architecture": { - "title": "CPU Architecture", + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", "type": "string" }, - "cpu_architecture_id": { + "integrity_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, 99 ], - "title": "CPU Architecture ID", + "title": "Integrity Level", "type": "integer" }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" }, - "cpu_type": { - "title": "Processor Type", + "path": { + "title": "Path", "type": "string" }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" + "pid": { + "title": "Process ID", + "type": "integer" }, - "gpu_count": { - "title": "GPU Count", + "ptid": { + "title": "Process Thread ID", "type": "integer" }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" + "sandbox": { + "title": "Sandbox", + "type": "string" }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "ram_size": { - "title": "RAM Size", + "terminated_time": { + "title": "Terminated Time", "type": "integer" }, - "serial_number": { - "title": "Serial Number", - "type": "string" + "tid": { + "title": "Thread ID", + "type": "integer" }, - "uuid": { - "title": "UUID", + "uid": { + "title": "Unique ID", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" } }, - "title": "Device Hardware Info", + "title": "Process", "type": "object" }, - "digital_signature": { + "vulnerability": { "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], "properties": { - "algorithm": { - "title": "Algorithm", + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" }, - "created_time": { - "title": "Created Time", + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", "type": "integer" }, - "developer_uid": { - "title": "Developer UID", + "exploit_ref_url": { + "title": "Exploit URL", "type": "string" }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" }, - "state": { - "title": "State", + "exploit_type": { + "title": "Exploit Type", "type": "string" }, - "state_id": { + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, 99 ], - "title": "State ID", + "title": "Fix Coverage ID", "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", "type": "integer" }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" }, - "occurrences": { + "references": { "items": { - "$ref": "#/$defs/occurrence_details" + "type": "string" }, - "title": "Occurrences", + "title": "References", "type": "array" }, - "type": { - "title": "Type", + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", "type": "string" }, - "value": { - "title": "Value", + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "title": "Discovery Details", + "title": "Vulnerability Details", "type": "object" }, - "display": { + "affected_code": { "additionalProperties": false, "properties": { - "color_depth": { - "title": "Color Depth", + "end_column": { + "title": "End Column", "type": "integer" }, - "physical_height": { - "title": "Physical Height", + "end_line": { + "title": "End Line", "type": "integer" }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "physical_width": { - "title": "Physical Width", + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", "type": "integer" }, - "scale_factor": { - "title": "Scale Factor", + "start_line": { + "title": "Start Line", "type": "integer" } }, - "title": "Display", + "required": [ + "file" + ], + "title": "Affected Code", "type": "object" }, - "dns_answer": { + "keyboard_info": { "additionalProperties": false, "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", + "function_keys": { + "title": "Function Keys", "type": "integer" }, - "rdata": { - "title": "DNS RData", + "ime": { + "title": "IME", "type": "string" }, - "ttl": { - "title": "TTL", + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", "type": "integer" }, - "type": { - "title": "Resource Record Type", + "keyboard_type": { + "title": "Keyboard Type", "type": "string" } }, - "required": [ - "rdata" - ], - "title": "DNS Answer", + "title": "Keyboard Information", "type": "object" }, - "domain_contact": { + "certificate": { "additionalProperties": false, "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" }, - "phone_number": { - "title": "Phone Number", + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", "type": "string" }, - "type": { - "title": "Domain Contact Type", + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" + "subject": { + "title": "Subject Distinguished Name", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "type_id" + "issuer", + "serial_number" ], - "title": "Domain Contact", + "title": "Digital Certificate", "type": "object" }, - "edge": { + "graph": { "additionalProperties": false, "anyOf": [ { @@ -2121,8 +2266,16 @@ } ], "properties": { - "data": { - "title": "Data" + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" }, "is_directed": { "title": "Directed", @@ -2132,16 +2285,34 @@ "title": "Name", "type": "string" }, - "relation": { - "title": "Relation", - "type": "string" + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" }, - "source": { - "title": "Source", + "query_language": { + "title": "Query Language", "type": "string" }, - "target": { - "title": "Target", + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, "uid": { @@ -2150,354 +2321,290 @@ } }, "required": [ - "source", - "target" + "nodes" ], - "title": "Edge", + "title": "Graph", "type": "object" }, - "email": { + "account": { "additionalProperties": false, "anyOf": [ { "required": [ - "from" + "name" ] }, { "required": [ - "to" + "uid" ] } ], "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" + "is_disabled": { + "title": "Disabled", + "type": "boolean" }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" + "is_locked": { + "title": "Locked", + "type": "boolean" }, - "delivered_to": { - "title": "Delivered To", - "type": "string" + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" }, - "delivered_to_list": { + "labels": { "items": { "type": "string" }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", + "title": "Labels", "type": "array" }, - "from": { - "title": "From", + "name": { + "title": "Name", "type": "string" }, - "from_list": { + "tags": { "items": { - "type": "string" + "$ref": "#/$defs/key_value_object" }, - "title": "From List", + "title": "Tags", "type": "array" }, - "from_mailbox": { - "title": "From Mailbox", + "type": { + "title": "Type", "type": "string" }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" }, - "is_read": { - "title": "Read", - "type": "boolean" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "message_uid": { - "title": "Message UID", + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "raw_header": { - "title": "Raw Header", + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", "type": "string" }, - "reply_to": { - "title": "Reply To", + "type": { + "title": "Type", "type": "string" }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" }, - "sender": { - "title": "Sender", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "sender_mailbox": { - "title": "Sender Mailbox", + "expiration_reason": { + "title": "Expiration Reason", "type": "string" }, - "size": { - "title": "Size", + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "smtp_from": { - "title": "SMTP From", - "type": "string" + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" + "is_remote": { + "title": "Remote", + "type": "boolean" }, - "subject": { - "title": "Subject", + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", "type": "string" }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", + "terminal": { + "title": "Terminal", "type": "string" }, - "dmarc_override": { - "title": "DMARC Override", + "uid": { + "title": "Unique ID", "type": "string" }, - "dmarc_policy": { - "title": "DMARC Policy", + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "spf": { - "title": "SPF Status", + "uuid": { + "title": "UUID", "type": "string" } }, - "title": "Email Authentication", + "title": "Session", "type": "object" }, - "encryption_details": { + "d3f_technique": { "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "type": { - "title": "Encryption Type", - "type": "string" + { + "required": [ + "uid" + ] } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, + ], "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, "src_url": { "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", + "title": "MITRE D3FEND\u2122 Technique", "type": "object" }, - "environment_variable": { + "image": { "additionalProperties": false, "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "path": { + "title": "Path", "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" }, - "score": { - "title": "EPPS Score", + "tag": { + "title": "Image Tag", "type": "string" }, - "version": { - "title": "Version", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "score" + "uid" ], - "title": "EPSS", + "title": "Image", "type": "object" }, - "extension": { + "application": { "additionalProperties": false, "anyOf": [ { @@ -2512,129 +2619,105 @@ } ], "properties": { - "name": { - "title": "Name", + "criticality": { + "title": "Business Criticality", "type": "string" }, - "uid": { - "title": "Unique ID", + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", "type": "string" }, - "version": { - "title": "Version", + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, "name": { - "title": "Name", + "title": "Application Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { + "owner": { "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" + "title": "Owner" }, - "company_name": { - "title": "Company Name", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" }, - "confidentiality": { - "title": "Confidentiality", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "confidentiality_id": { + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Confidentiality ID", + "title": "Risk Level ID", "type": "integer" }, - "created_time": { - "title": "Created Time", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" }, - "desc": { - "title": "Description", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", "type": "string" }, - "drive_type": { - "title": "Drive Type", + "uid": { + "title": "Application ID", "type": "string" }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "ext": { - "title": "File Extension", + "version": { + "title": "Application Version", "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" }, "hashes": { "items": { @@ -2643,90 +2726,111 @@ "title": "Hashes", "type": "array" }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "internal_name": { - "title": "Internal Name", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" + "type": { + "title": "Type", + "type": "string" }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "is_system": { - "title": "System", - "type": "boolean" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" }, - "mime_type": { - "title": "MIME type", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "modified_time": { - "title": "Modified Time", + "epoch": { + "title": "Epoch", "type": "integer" }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "package_manager": { + "title": "Package Manager", + "type": "string" }, - "parent_folder": { - "title": "Parent Folder", + "package_manager_url": { + "title": "Package Manager URL", "type": "string" }, "path": { "title": "Path", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", + "purl": { + "title": "Package URL", "type": "string" }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" + "release": { + "title": "Software Release Details", + "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "src_url": { + "title": "Source URL", + "type": "string" }, "type": { "title": "Type", @@ -2737,97 +2841,54 @@ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, - 8, 99 ], "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", + "title": "Package UID", "type": "string" }, - "uri": { - "title": "File URI", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, "version": { "title": "Version", "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, "required": [ "name", - "type_id" + "version" ], - "title": "File", + "title": "Affected Software Package", "type": "object" }, - "fingerprint": { + "cis_control": { "additionalProperties": false, "properties": { - "algorithm": { - "title": "Algorithm", + "desc": { + "title": "Description", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "value": { - "title": "Value", + "version": { + "title": "Version", "type": "string" } }, "required": [ - "algorithm_id", - "value" + "name" ], - "title": "Fingerprint", + "title": "CIS Control", "type": "object" }, - "firewall_rule": { + "analytic": { "additionalProperties": false, "anyOf": [ { @@ -2842,69 +2903,49 @@ } ], "properties": { - "category": { - "title": "Category", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "condition": { - "title": "Condition", + "category": { + "title": "Category", "type": "string" }, "desc": { "title": "Description", "type": "string" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "match_details": { + "related_analytics": { "items": { - "type": "string" + "$ref": "#/$defs/analytic" }, - "title": "Match Details", + "title": "Related Analytics", "type": "array" }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", + "state": { + "title": "State", "type": "string" }, - "rate_limit": { - "title": "Rate Limit", + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", "type": "integer" }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { + "type_id": { "enum": [ 0, 1, @@ -2914,46 +2955,31 @@ 5, 6, 7, + 8, + 9, + 10, + 11, 99 ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", + "title": "Type ID", "type": "integer" }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "vram_mode": { - "title": "VRAM Mode", + "version": { + "title": "Version", "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" } }, - "title": "GPU Information", + "required": [ + "type_id" + ], + "title": "Analytic", "type": "object" }, - "graph": { + "edge": { "additionalProperties": false, "anyOf": [ { @@ -2968,16 +2994,8 @@ } ], "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "edges": { - "items": { - "$ref": "#/$defs/edge" - }, - "title": "Edges", - "type": "array" + "data": { + "title": "Data" }, "is_directed": { "title": "Directed", @@ -2987,34 +3005,16 @@ "title": "Name", "type": "string" }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" - }, - "query_language": { - "title": "Query Language", + "relation": { + "title": "Relation", "type": "string" }, - "query_language_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Query Language ID", - "type": "integer" + "source": { + "title": "Source", + "type": "string" }, - "type": { - "title": "Type", + "target": { + "title": "Target", "type": "string" }, "uid": { @@ -3023,194 +3023,166 @@ } }, "required": [ - "nodes" + "source", + "target" ], - "title": "Graph", + "title": "Edge", "type": "object" }, - "group": { + "actor": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "app_name" ] }, { "required": [ - "uid" + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" ] } ], "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", + "app_name": { + "title": "Application Name", "type": "string" }, - "name": { - "title": "Name", + "app_uid": { + "title": "Application ID", "type": "string" }, - "privileges": { + "authorizations": { "items": { - "type": "string" + "$ref": "#/$defs/authorization" }, - "title": "Privileges", + "title": "Authorization Information", "type": "array" }, - "type": { - "title": "Group Type", - "type": "string" + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" }, - "uid": { - "title": "Unique ID", + "invoked_by": { + "title": "Invoked by", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "process": { + "$ref": "#/$defs/process", + "title": "Process" }, - "value": { - "title": "Value", - "type": "string" + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" } }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", + "title": "Actor", "type": "object" }, - "http_request": { + "cloud": { "additionalProperties": false, "properties": { - "args": { - "title": "HTTP Arguments", - "type": "string" - }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", + "cloud_partition": { + "title": "Cloud Partition", "type": "string" }, - "length": { - "title": "Request Length", - "type": "integer" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "referrer": { - "title": "HTTP Referrer", + "project_uid": { + "title": "Project ID", "type": "string" }, - "uid": { - "title": "Unique ID", + "provider": { + "title": "Cloud Provider", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", + "region": { + "title": "Region", "type": "string" }, - "version": { - "title": "HTTP Version", + "zone": { + "title": "Cloud Availability Zone", "type": "string" - }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" } }, - "title": "HTTP Request", + "required": [ + "provider" + ], + "title": "Cloud", "type": "object" }, - "http_response": { + "trace": { "additionalProperties": false, "properties": { - "body_length": { - "title": "Response Body Length", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "code": { - "title": "Response Code", + "end_time": { + "title": "End Time", "type": "integer" }, - "content_type": { - "title": "HTTP Content Type", - "type": "string" - }, - "http_headers": { + "flags": { "items": { - "$ref": "#/$defs/http_header" + "type": "string" }, - "title": "HTTP Headers", + "title": "Flags", "type": "array" }, - "latency": { - "title": "Latency", - "type": "integer" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "length": { - "title": "Response Length", - "type": "integer" + "span": { + "$ref": "#/$defs/span", + "title": "Span" }, - "message": { - "title": "Message", - "type": "string" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "status": { - "title": "Status", + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "code" + "uid" ], - "title": "HTTP Response", + "title": "Trace", "type": "object" }, - "idp": { + "ai_model": { "additionalProperties": false, "anyOf": [ { @@ -3225,588 +3197,668 @@ } ], "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", + "ai_provider": { + "title": "AI Provider", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "uid": { + "title": "Unique ID", "type": "string" }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" + "is_system": { + "title": "System", + "type": "boolean" }, - "state": { - "title": "State", - "type": "string" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" }, - "state_id": { + "confidentiality_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, 99 ], - "title": "State ID", + "title": "Confidentiality ID", "type": "integer" }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" }, - "name": { - "title": "Name", - "type": "string" + "is_readonly": { + "title": "Read-Only", + "type": "boolean" }, - "path": { - "title": "Path", + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", "type": "string" }, - "tag": { - "title": "Image Tag", + "company_name": { + "title": "Company Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "attributes": { + "title": "Attributes", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "desc": { + "title": "Description", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" + "type": { + "title": "Type", + "type": "string" }, - "bulletin": { - "title": "Patch Bulletin", + "path": { + "title": "Path", "type": "string" }, - "classification": { - "title": "Classification", + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", "type": "string" }, "created_time": { "title": "Created Time", "type": "integer" }, - "install_state": { - "title": "Install State", + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", "type": "string" }, - "install_state_id": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, + 8, 99 ], - "title": "Install State ID", + "title": "Type ID", "type": "integer" }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "size": { + "title": "Size", + "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "severity": { - "title": "Severity", + "internal_name": { + "title": "Internal Name", "type": "string" }, - "size": { - "title": "Size", + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", "type": "integer" }, - "src_url": { - "title": "Source URL", + "security_descriptor": { + "title": "Security Descriptor", "type": "string" }, - "title": { - "title": "Title", + "volume": { + "title": "Volume", "type": "string" }, - "uid": { - "title": "Unique ID", + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "KB Article", + "required": [ + "name", + "type_id" + ], + "title": "File", "type": "object" }, - "key_value_object": { + "remediation": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], "properties": { - "name": { - "title": "Name", - "type": "string" + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" }, - "value": { - "title": "Value", + "desc": { + "title": "Description", "type": "string" }, - "values": { + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { "items": { "type": "string" }, - "title": "Values", + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", "type": "array" } }, "required": [ - "name" + "desc" ], - "title": "Key:Value object", + "title": "Remediation", "type": "object" }, - "keyboard_info": { + "email": { "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" + "anyOf": [ + { + "required": [ + "from" + ] }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" + { + "required": [ + "to" + ] } - }, - "required": [ - "phase_id" ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, "properties": { - "cost_center": { - "title": "Cost Center", + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" }, - "department": { - "title": "Department", + "from": { + "title": "From", "type": "string" }, - "display_name": { - "title": "Display Name", + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", "type": "string" }, - "email_addrs": { + "from_mailboxes": { "items": { "type": "string" }, - "title": "Email Addresses", + "title": "From Mailboxes", "type": "array" }, - "employee_uid": { - "title": "Employee ID", - "type": "string" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "given_name": { - "title": "Given Name", + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", "type": "string" }, - "hire_time": { - "title": "Hire Time", - "type": "integer" + "raw_header": { + "title": "Raw Header", + "type": "string" }, - "job_title": { - "title": "Job Title", + "reply_to": { + "title": "Reply To", "type": "string" }, - "labels": { + "reply_to_list": { "items": { "type": "string" }, - "title": "Labels", + "title": "Reply To List", "type": "array" }, - "last_login_time": { - "title": "Last Login", - "type": "integer" + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" }, - "ldap_cn": { - "title": "LDAP Common Name", + "return_path": { + "title": "Return Path", "type": "string" }, - "ldap_dn": { - "title": "LDAP Distinguished Name", + "sender": { + "title": "Sender", "type": "string" }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" }, - "modified_time": { - "title": "Modified Time", + "size": { + "title": "Size", "type": "integer" }, - "office_location": { - "title": "Office Location", + "smtp_from": { + "title": "SMTP From", "type": "string" }, - "phone_number": { - "title": "Telephone Number", + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", "type": "string" }, - "surname": { - "title": "Surname", + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", "type": "string" }, - "tags": { + "urls": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/url" }, - "title": "Tags", + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", "type": "array" } }, - "title": "LDAP Person", + "title": "Email", "type": "object" }, - "location": { + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "city" + "name" ] }, { "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" + "uid" ] } ], "properties": { - "aerial_height": { - "title": "Aerial Height", + "name": { + "title": "Name", "type": "string" }, - "city": { - "title": "City", + "src_url": { + "title": "Source URL", "type": "string" }, - "continent": { - "title": "Continent", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", "type": "string" }, - "coordinates": { + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { "items": { - "type": "number" + "$ref": "#/$defs/http_header" }, - "title": "Coordinates", + "title": "HTTP Headers", "type": "array" }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", "type": "string" }, - "geohash": { - "title": "Geohash", - "type": "string" + "length": { + "title": "Request Length", + "type": "integer" }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", + "referrer": { + "title": "HTTP Referrer", "type": "string" }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "pressure_altitude": { - "title": "Pressure Altitude", + "user_agent": { + "title": "HTTP User-Agent", "type": "string" }, - "provider": { - "title": "Provider", + "version": { + "title": "HTTP Version", "type": "string" }, - "region": { - "title": "Region", - "type": "string" + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" } }, - "title": "Geo Location", + "title": "HTTP Request", "type": "object" }, - "logger": { + "cvss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "base_score": { + "title": "Base Score", + "type": "number" }, - "log_format": { - "title": "Log Format", + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", "type": "string" }, - "log_level": { - "title": "Log Level", - "type": "string" + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" }, - "log_name": { - "title": "Log Name", - "type": "string" + "overall_score": { + "title": "Overall Score", + "type": "number" }, - "log_provider": { - "title": "Log Provider", + "severity": { + "title": "Severity", "type": "string" }, - "log_version": { - "title": "Log Version", + "src_url": { + "title": "Source URL", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", + "vector_string": { + "title": "Vector String", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Logger", + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", "type": "object" }, - "long_string": { + "fingerprint": { "additionalProperties": false, "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "algorithm": { + "title": "Algorithm", + "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", "type": "integer" }, "value": { @@ -3815,111 +3867,69 @@ } }, "required": [ + "algorithm_id", "value" ], - "title": "Long String", + "title": "Fingerprint", "type": "object" }, - "malware": { + "process_entity": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "cmd_line" ] }, { "required": [ - "uid" + "cpid" ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" + { + "required": [ + "name" + ] }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" + { + "required": [ + "path" + ] }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" + { + "required": [ + "pid" + ] }, - "name": { - "title": "Name", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "provider": { - "title": "Provider", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", "type": "string" }, - "severity": { - "title": "Severity", + "path": { + "title": "Path", "type": "string" }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", + "pid": { + "title": "Process ID", "type": "integer" }, "uid": { @@ -3927,54 +3937,23 @@ "type": "string" } }, - "required": [ - "classification_ids" - ], - "title": "Malware", + "title": "Process Entity", "type": "object" }, - "malware_scan_info": { + "observable": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "end_time": { - "title": "End Time", - "type": "integer" + "event_uid": { + "title": "Event UID", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, "type": { "title": "Type", @@ -3990,277 +3969,230 @@ 5, 6, 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, 99 ], "title": "Type ID", "type": "integer" }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", + "type_uid": { + "title": "Type ID", "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" } }, "required": [ "type_id" ], - "title": "Malware Scan Info", + "title": "Observable", "type": "object" }, - "message_context": { + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { "additionalProperties": false, "anyOf": [ { "required": [ - "application" + "sub_technique" ] }, { "required": [ - "service" + "tactic" + ] + }, + { + "required": [ + "technique" ] } ], "properties": { - "ai_role": { - "title": "AI Role", - "type": "string" + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" }, - "ai_role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "AI Role ID", - "type": "integer" - }, - "application": { - "$ref": "#/$defs/application", - "title": "Application" - }, - "completion_tokens": { - "title": "Completion Tokens", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" }, - "prompt_tokens": { - "title": "Prompt Tokens", - "type": "integer" + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" }, - "total_tokens": { - "title": "Total Tokens", - "type": "integer" + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" }, - "uid": { - "title": "Unique ID", + "version": { + "title": "Version", "type": "string" } }, - "title": "Message Context", + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", "type": "object" }, - "metadata": { + "network_interface": { "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "log_name": { - "title": "Log Name", - "type": "string" + { + "required": [ + "ip" + ] }, - "log_provider": { - "title": "Log Provider", - "type": "string" + { + "required": [ + "mac" + ] }, - "log_source": { - "title": "Log Source", - "type": "string" + { + "required": [ + "name" + ] }, - "log_version": { - "title": "Log Version", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", + "ip": { + "title": "IP Address", "type": "string" }, - "original_time": { - "title": "Original Time", + "mac": { + "title": "MAC Address", "type": "string" }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", + "name": { + "title": "Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", + "namespace": { + "title": "Namespace", "type": "string" }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { + "open_ports": { "items": { - "$ref": "#/$defs/transformation_info" + "$ref": "#/$defs/port_info" }, - "title": "Transformation Info", + "title": "Open Ports", "type": "array" }, - "transmit_time": { - "title": "Transmission Time", + "subnet_prefix": { + "title": "Subnet Prefix Length", "type": "integer" }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "name", - "value" - ], - "title": "Metric", + "title": "Network Interface", "type": "object" }, - "mitigation": { + "user": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "account" + ] + }, { "required": [ "name" @@ -4273,203 +4205,132 @@ } ], "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "src_url": { - "title": "Source URL", + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "uid": { - "title": "Unique ID", + "display_name": { + "title": "Display Name", "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_endpoint": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" }, "domain": { "title": "Domain", "type": "string" }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", + "email_addr": { + "title": "Email Address", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "forward_addr": { + "title": "Forwarding Address", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "full_name": { + "title": "Full Name", "type": "string" }, - "intermediate_ips": { + "groups": { "items": { - "type": "string" + "$ref": "#/$defs/group" }, - "title": "Intermediate IP Addresses", + "title": "Groups", "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" }, - "isp": { - "title": "ISP Name", - "type": "string" + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" }, - "isp_org": { - "title": "ISP Org", + "name": { + "title": "Name", "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "mac_vendor": { - "title": "MAC Vendor", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" }, - "network_scope": { - "title": "Network Scope", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "network_scope_id": { + "risk_level_id": { "enum": [ 0, 1, 2, + 3, + 4, 99 ], - "title": "Network Scope ID", + "title": "Risk Level ID", "type": "integer" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "type": { + "title": "Type", + "type": "string" }, - "port": { - "title": "Port", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" + "uid": { + "title": "Unique ID", + "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "uid_alt": { + "title": "Alternate ID", "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "svc_name": { - "title": "Service Name", + "email_addr": { + "title": "Email Address", "type": "string" }, - "type": { - "title": "Type", + "factor_type": { + "title": "Factor Type", "type": "string" }, - "type_id": { + "factor_type_id": { "enum": [ 0, 1, @@ -4483,292 +4344,226 @@ 9, 10, 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "Factor Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" }, - "vpc_uid": { - "title": "VPC UID", + "phone_number": { + "title": "Phone Number", "type": "string" }, - "zone": { - "title": "Network Zone", + "provider": { + "title": "Provider", "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" } + }, + "required": [ + "factor_type_id" ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, "properties": { - "hostname": { - "title": "Hostname", + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", "type": "string" }, - "ip": { - "title": "IP Address", + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", "type": "string" }, - "mac": { - "title": "MAC Address", + "detection_pattern": { + "title": "Detection Pattern", "type": "string" }, - "name": { - "title": "Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "namespace": { - "title": "Namespace", + "category": { + "title": "Category", "type": "string" }, - "open_ports": { + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { "items": { - "$ref": "#/$defs/port_info" + "type": "string" }, - "title": "Open Ports", + "title": "Related Subdomains", "type": "array" }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, "type": { "title": "Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", + "uploaded_time": { + "title": "Uploaded Time", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "network_proxy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - { - "required": [ - "interface_name" - ] + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - { - "required": [ - "interface_uid" - ] + "comment": { + "title": "Analyst Comments", + "type": "string" }, - { - "required": [ - "ip" - ] + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - { - "required": [ - "name" - ] + "value": { + "title": "Indicator", + "type": "string" }, - { - "required": [ - "svc_name" - ] + "created_time": { + "title": "Created Time", + "type": "integer" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { + "intrusion_sets": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "Intrusion Sets", "type": "array" }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" }, - "domain": { - "title": "Domain", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "fingerprints": { + "attacks": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/attack" }, - "title": "Fingerprints", + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", "type": "array" }, - "hostname": { - "title": "Hostname", - "type": "string" + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "file": { + "$ref": "#/$defs/file", + "title": "Related File" }, - "instance_uid": { - "title": "Instance ID", - "type": "string" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "interface_name": { - "title": "Network Interface Name", + "name": { + "title": "Name", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" }, - "intermediate_ips": { + "kill_chain": { "items": { - "type": "string" + "$ref": "#/$defs/kill_chain_phase" }, - "title": "Intermediate IP Addresses", + "title": "Kill Chain", "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { + "detection_pattern_type_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", + "title": "Detection Pattern Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", + "detection_pattern_type": { + "title": "Detection Pattern", "type": "string" }, - "svc_name": { - "title": "Service Name", - "type": "string" + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" }, "type_id": { "enum": [ @@ -4787,42 +4582,91 @@ 12, 13, 14, - 15, 99 ], - "title": "Type ID", + "title": "Indicator Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "vlan_uid": { - "title": "VLAN", + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", "type": "string" }, - "vpc_uid": { - "title": "VPC UID", + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "zone": { - "title": "Network Zone", + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" } }, - "title": "Network Proxy Endpoint", + "required": [ + "type_id", + "value" + ], + "title": "OSINT", "type": "object" }, - "node": { + "san": { "additionalProperties": false, "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" @@ -4830,182 +4674,83 @@ "type": { "title": "Type", "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" } }, "required": [ - "uid" + "name", + "type" ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", + "title": "Subject Alternative Name", "type": "object" }, - "observable": { + "occurrence_details": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], "properties": { - "event_uid": { - "title": "Event UID", + "cell_name": { + "title": "Cell Name", "type": "string" }, - "name": { - "title": "Name", + "column_name": { + "title": "Column Name", "type": "string" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "column_number": { + "title": "Column Number", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", "type": "string" }, "page_number": { @@ -5028,7 +4773,7 @@ "title": "Occurrence Details", "type": "object" }, - "organization": { + "firewall_rule": { "additionalProperties": false, "anyOf": [ { @@ -5043,91 +4788,164 @@ } ], "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "ou_name": { - "title": "Org Unit Name", + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", "type": "string" }, - "ou_uid": { - "title": "Org Unit ID", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Organization", + "title": "Firewall Rule", "type": "object" }, - "os": { + "threat_actor": { "additionalProperties": false, "properties": { - "build": { - "title": "OS Build", + "name": { + "title": "Name", "type": "string" }, - "country": { - "title": "Country", + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", "type": "string" }, "cpe_name": { "title": "The product CPE identifier", "type": "string" }, - "cpu_bits": { - "title": "CPU Bits", + "epoch": { + "title": "Epoch", "type": "integer" }, - "edition": { - "title": "OS Edition", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "kernel_release": { - "title": "Kernel Release", + "license": { + "title": "Software License", "type": "string" }, - "lang": { - "title": "Language", + "license_url": { + "title": "Software License URL", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "sp_name": { - "title": "OS Service Pack", + "package_manager": { + "title": "Package Manager", "type": "string" }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" }, - "type": { - "title": "Type", + "purl": { + "title": "Package URL", "type": "string" }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 ], "title": "Type ID", "type": "integer" }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, "version": { "title": "Version", "type": "string" @@ -5135,382 +4953,420 @@ }, "required": [ "name", - "type_id" + "version" ], - "title": "Operating System (OS)", + "title": "Software Package", "type": "object" }, - "osint": { + "transformation_info": { "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "comment": { - "title": "Analyst Comments", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", "type": "string" }, - "confidence": { - "title": "Confidence", + "name": { + "title": "Name", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "created_time": { - "title": "Created Time", + "time": { + "title": "Event Time", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", + "uid": { + "title": "Unique ID", "type": "string" }, - "detection_pattern_type": { - "title": "Detection Pattern", + "url_string": { + "title": "URL String", "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", "type": "integer" }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "data": { + "title": "Data" }, - "external_uid": { - "title": "External ID", + "error": { + "title": "Error Code", "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" + "error_message": { + "title": "Error Message", + "type": "string" }, - "intrusion_sets": { + "flags": { "items": { "type": "string" }, - "title": "Intrusion Sets", + "title": "Flags", "type": "array" }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + { + "required": [ + "ip" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "name" + ] }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "ip": { + "title": "IP Address", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { "items": { - "$ref": "#/$defs/digital_signature" + "type": "string" }, - "title": "Related Digital Signatures", + "title": "Website Categorization", "type": "array" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { + "category_ids": { "items": { - "type": "string" + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" }, - "title": "Related Subdomains", + "title": "Website Categorization IDs", "type": "array" }, - "subnet": { - "title": "Related Subnet", + "domain": { + "title": "Domain", "type": "string" }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", + "hostname": { + "title": "Hostname", "type": "string" }, - "type": { - "title": "Type", + "path": { + "title": "Path", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", + "port": { + "title": "Port", "type": "integer" }, - "uid": { - "title": "Unique ID", + "query_string": { + "title": "HTTP Query String", "type": "string" }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", + "resource_type": { + "title": "Resource Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "scheme": { + "title": "Scheme", "type": "string" }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" + "subdomain": { + "title": "Subdomain", + "type": "string" }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" + "url_string": { + "title": "URL String", + "type": "string" } }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", + "title": "Uniform Resource Locator", "type": "object" }, - "package": { + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "architecture": { - "title": "Architecture", + "name": { + "title": "Name", "type": "string" }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", + "uid": { + "title": "Unique ID", "type": "string" }, - "name": { - "title": "Name", + "version": { + "title": "Version", "type": "string" - }, - "package_manager": { - "title": "Package Manager", + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" }, - "purl": { - "title": "Package URL", - "type": "string" + "cores": { + "title": "Cores", + "type": "integer" }, - "release": { - "title": "Software Release Details", + "model": { + "title": "Model", "type": "string" }, - "src_url": { - "title": "Source URL", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "type": { - "title": "Type", + "vram_mode": { + "title": "VRAM Mode", "type": "string" }, - "type_id": { + "vram_mode_id": { "enum": [ 0, 1, 2, 99 ], - "title": "Type ID", + "title": "VRAM Mode ID", "type": "integer" }, - "uid": { - "title": "Package UID", - "type": "string" + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" }, - "vendor_name": { - "title": "Vendor Name", + "protocol_name": { + "title": "Protocol Name", "type": "string" }, - "version": { - "title": "Version", - "type": "string" + "protocol_num": { + "title": "Protocol Number", + "type": "integer" } }, "required": [ - "name", - "version" + "port" ], - "title": "Software Package", + "title": "Port Information", "type": "object" }, - "policy": { + "service": { "additionalProperties": false, "anyOf": [ { @@ -5518,11 +5374,6 @@ "name" ] }, - { - "required": [ - "type" - ] - }, { "required": [ "uid" @@ -5530,28 +5381,23 @@ } ], "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "uid": { "title": "Unique ID", @@ -5562,42 +5408,96 @@ "type": "string" } }, - "title": "Policy", + "title": "Service", "type": "object" }, - "port_info": { + "metric": { "additionalProperties": false, "properties": { - "port": { - "title": "Port", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "protocol_name": { - "title": "Protocol Name", + "value": { + "title": "Value", "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" } }, "required": [ - "port" + "uid" ], - "title": "Port Information", + "title": "Request Elements", "type": "object" }, - "process": { + "sub_technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "cpid" + "name" ] }, { "required": [ - "pid" + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" ] }, { @@ -5607,132 +5507,178 @@ } ], "properties": { - "ancestry": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { "items": { - "$ref": "#/$defs/process_entity" + "type": "string" }, - "title": "Ancestry", + "title": "Labels", "type": "array" }, - "cmd_line": { - "title": "Command Line", + "name": { + "title": "Name", "type": "string" }, - "cpid": { - "title": "Common Process Identifier", + "network_driver": { + "title": "Network Driver", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" + "orchestrator": { + "title": "Orchestrator", + "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "File" + "pod_uuid": { + "title": "Pod UUID", + "type": "string" }, - "hosted_services": { + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { "items": { - "$ref": "#/$defs/win_win_service" + "$ref": "#/$defs/key_value_object" }, - "title": "Hosted Services", + "title": "Tags", "type": "array" }, - "integrity": { - "title": "Integrity", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" }, - "lineage": { + "classifications": { "items": { "type": "string" }, - "title": "Lineage", + "title": "Classifications", "type": "array" }, - "loaded_modules": { + "cves": { "items": { - "type": "string" + "$ref": "#/$defs/cve" }, - "title": "Loaded Modules", + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", "type": "array" }, "name": { "title": "Name", "type": "string" }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" }, "path": { "title": "Path", "type": "string" }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", + "provider": { + "title": "Provider", "type": "string" }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" + "severity": { + "title": "Severity", + "type": "string" }, - "tid": { - "title": "Thread ID", + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, - "title": "Process", + "required": [ + "classification_ids" + ], + "title": "Malware", "type": "object" }, - "process_entity": { + "win_win_service": { "additionalProperties": false, "anyOf": [ { @@ -5742,27 +5688,32 @@ }, { "required": [ - "cpid" + "service_category_id" ] }, { "required": [ - "name" + "service_dependencies" ] }, { "required": [ - "path" + "service_error_control_id" ] }, { "required": [ - "pid" + "service_start_name" ] }, { "required": [ - "uid" + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" ] } ], @@ -5771,79 +5722,116 @@ "title": "Command Line", "type": "string" }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "service_category": { + "title": "Service Category", "type": "string" }, - "pid": { - "title": "Process ID", + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", "type": "integer" }, - "uid": { - "title": "Unique ID", + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" }, - "lang": { - "title": "Language", + "service_start_name": { + "title": "Service Start Name", "type": "string" }, - "name": { - "title": "Name", + "service_start_type": { + "title": "Service Start Type", "type": "string" }, - "path": { - "title": "Path", - "type": "string" + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "service_type": { + "title": "Service Type", "type": "string" }, - "url_string": { - "title": "URL String", - "type": "string" + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" }, - "vendor_name": { - "title": "Vendor Name", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", "type": "string" }, "version": { @@ -5851,74 +5839,63 @@ "type": "string" } }, - "title": "Product", + "required": [ + "name" + ], + "title": "Windows Service", "type": "object" }, - "programmatic_credential": { + "group": { "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "uid": { - "title": "Unique ID", - "type": "string" + { + "required": [ + "uid" + ] } - }, - "required": [ - "uid" ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, "desc": { "title": "Description", "type": "string" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "domain": { + "title": "Domain", + "type": "string" }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "references": { + "privileges": { "items": { "type": "string" }, - "title": "References", + "title": "Privileges", "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "required": [ - "desc" - ], - "title": "Remediation", + "title": "Group", "type": "object" }, - "reporter": { + "device": { "additionalProperties": false, "anyOf": [ { @@ -5926,6 +5903,21 @@ "hostname" ] }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, { "required": [ "ip" @@ -5943,183 +5935,196 @@ } ], "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", + "region": { + "title": "Region", "type": "string" }, - "name": { - "title": "Name", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, "uid": { "title": "Unique ID", "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" }, - "score": { - "title": "Reputation Score", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", + "modified_time": { + "title": "Modified Time", "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" }, - "data": { - "title": "Data" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" + "desc": { + "title": "Description", + "type": "string" }, - "uid": { - "title": "Unique ID", + "os_machine_uuid": { + "title": "OS Machine UUID", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "resource_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "IMEI List", "type": "array" }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, "created_time": { "title": "Created Time", "type": "integer" }, - "criticality": { - "title": "Criticality", - "type": "string" - }, - "data": { - "title": "Data" + "is_shared": { + "title": "Shared Device", + "type": "boolean" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "hostname": { - "title": "Hostname", + "meid": { + "title": "MEID", "type": "string" }, - "ip": { - "title": "IP Address", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" + "zone": { + "title": "Network Zone", + "type": "string" }, - "labels": { + "groups": { "items": { - "type": "string" + "$ref": "#/$defs/group" }, - "title": "Labels", + "title": "Groups", "type": "array" }, - "modified_time": { - "title": "Modified Time", + "risk_score": { + "title": "Risk Score", "type": "integer" }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, "name": { "title": "Name", "type": "string" }, - "namespace": { - "title": "Namespace", + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, "owner": { "$ref": "#/$defs/user", "title": "Owner" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" + "boot_time": { + "title": "Boot Time", + "type": "integer" }, - "role": { - "title": "Role", - "type": "string" + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" }, - "role_id": { + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "risk_level_id": { "enum": [ 0, 1, @@ -6128,136 +6133,184 @@ 4, 99 ], - "title": "Role ID", + "title": "Risk Level ID", "type": "integer" }, - "tags": { + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/network_interface" }, - "title": "Tags", + "title": "Network Interfaces", "type": "array" }, - "type": { - "title": "Type", + "autoscale_uid": { + "title": "Autoscale UID", "type": "string" }, - "uid": { - "title": "Unique ID", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "subnet": { + "title": "Subnet", "type": "string" }, - "version": { - "title": "Version", + "eid": { + "title": "EID", "type": "string" - } - }, - "title": "Resource Details", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" }, - "error": { - "title": "Error Code", + "domain": { + "title": "Domain", "type": "string" }, - "error_message": { - "title": "Error Message", + "imei": { + "title": "IMEI", "type": "string" }, - "flags": { + "agent_list": { "items": { - "type": "string" + "$ref": "#/$defs/agent" }, - "title": "Flags", + "title": "Agent List", "type": "array" }, - "message": { - "title": "Message", + "ip": { + "title": "IP Address", + "type": "string" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" + }, + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "title": "Response Elements", + "required": [ + "type_id" + ], + "title": "Device", "type": "object" }, - "rule": { + "campaign": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" - }, - "type": { - "title": "Type", + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", "type": "string" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "CWE ID", "type": "string" } }, - "title": "Rule", + "required": [ + "uid" + ], + "title": "CWE", "type": "object" }, - "san": { + "digital_signature": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "type": { - "title": "Type", + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" } }, "required": [ - "name", - "type" + "algorithm_id" ], - "title": "Subject Alternative Name", + "title": "Digital Signature", "type": "object" }, "sbom": { @@ -6313,146 +6366,91 @@ "title": "Software Bill of Materials", "type": "object" }, - "scim": { + "malware_scan_info": { "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, - "created_time": { - "title": "Created Time", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", "type": "integer" }, - "error_message": { - "title": "Last Error Message", + "name": { + "title": "Name", "type": "string" }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", + "num_files": { + "title": "Scanned Files", "type": "integer" }, - "modified_time": { - "title": "Modified Time", + "num_infected": { + "title": "Number of Infected Entities", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", + "num_volumes": { + "title": "Number of Volumes", "type": "integer" }, - "scim_group_schema": { - "title": "SCIM Group Schema" + "size": { + "title": "Size", + "type": "integer" }, - "scim_user_schema": { - "title": "SCIM User Schema" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "state": { - "title": "State", + "type": { + "title": "Type", "type": "string" }, - "state_id": { + "type_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, + 7, 99 ], - "title": "State ID", + "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", + "title": "Scan UID", "type": "string" }, - "version": { - "title": "SCIM Version", - "type": "string" + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" } }, - "title": "SCIM", - "type": "object" + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" }, - "script": { + "kill_chain_phase": { "additionalProperties": false, "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", + "phase": { + "title": "Kill Chain Phase", "type": "string" }, - "type_id": { + "phase_id": { "enum": [ 0, 1, @@ -6464,22 +6462,17 @@ 7, 99 ], - "title": "Type ID", + "title": "Kill Chain Phase ID", "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" } }, "required": [ - "script_content", - "type_id" + "phase_id" ], - "title": "Script", + "title": "Kill Chain Phase", "type": "object" }, - "service": { + "organization": { "additionalProperties": false, "anyOf": [ { @@ -6494,148 +6487,132 @@ } ], "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, "name": { "title": "Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "ou_name": { + "title": "Org Unit Name", + "type": "string" }, - "uid": { - "title": "Unique ID", + "ou_uid": { + "title": "Org Unit ID", "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Service", + "title": "Organization", "type": "object" }, - "session": { + "encryption_details": { "additionalProperties": false, "properties": { - "count": { - "title": "Count", + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", "type": "integer" }, - "created_time": { - "title": "Created Time", + "key_length": { + "title": "Encryption Key Length", "type": "integer" }, - "credential_uid": { - "title": "User Credential ID", + "key_uid": { + "title": "Key UID", "type": "string" }, - "expiration_reason": { - "title": "Expiration Reason", + "type": { + "title": "Encryption Type", "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "is_remote": { - "title": "Remote", - "type": "boolean" + "event_uid": { + "title": "Event UID", + "type": "string" }, - "is_vpn": { - "title": "VPN Session", + "is_truncated": { + "title": "Is Truncated", "type": "boolean" }, - "issuer": { - "title": "Issuer Details", + "log_format": { + "title": "Log Format", "type": "string" }, - "terminal": { - "title": "Terminal", + "log_level": { + "title": "Log Level", "type": "string" }, - "uid": { - "title": "Unique ID", + "log_name": { + "title": "Log Name", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "log_provider": { + "title": "Log Provider", "type": "string" }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "software_component": { - "additionalProperties": false, - "properties": { - "author": { - "title": "Author", + "log_version": { + "title": "Log Version", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" + "logged_time": { + "title": "Logged Time", + "type": "integer" }, "name": { "title": "Name", "type": "string" }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "related_component": { - "title": "Related Component", - "type": "string" - }, - "relationship": { - "title": "Relationship", - "type": "string" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "relationship_id": { - "enum": [ - 0, - 1, - 99 - ], - "title": "Relationship ID", + "transmit_time": { + "title": "Transmission Time", "type": "integer" }, - "type": { - "title": "Type", + "uid": { + "title": "Unique ID", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, "version": { @@ -6643,268 +6620,38 @@ "type": "string" } }, - "required": [ - "name", - "version" - ], - "title": "Software Component", + "title": "Logger", "type": "object" }, - "span": { + "feature": { "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" }, - "type": { - "title": "Threat Actor Type", + "version": { + "title": "Version", "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" } }, - "required": [ - "name" - ], - "title": "Threat Actor", + "title": "Feature", "type": "object" }, "timespan": { @@ -7027,37 +6774,146 @@ "title": "Time Span", "type": "object" }, - "token": { + "rule": { "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "desc": { + "title": "Description", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "tenant_uid": { - "title": "Tenant UID", + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", "type": "string" }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, "type": { "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, "type_id": { "enum": [ 0, @@ -7068,273 +6924,352 @@ 5, 6, 7, + 8, + 9, 99 ], "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", + "title": "Agent ID", "type": "string" }, - "zone": { - "title": "Network Zone", + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", "type": "string" } }, - "title": "Token", + "title": "Agent", "type": "object" }, - "trace": { + "whois": { "additionalProperties": false, "properties": { - "duration": { - "title": "Duration Milliseconds", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", "type": "integer" }, - "end_time": { - "title": "End Time", + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", "type": "integer" }, - "flags": { + "domain": { + "title": "Domain", + "type": "string" + }, + "domain_contacts": { "items": { - "type": "string" + "$ref": "#/$defs/domain_contact" }, - "title": "Flags", + "title": "Domain Contacts", "type": "array" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" + "isp": { + "title": "ISP Name", + "type": "string" }, - "start_time": { - "title": "Start Time", + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", "type": "integer" }, - "uid": { - "title": "Unique ID", + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Trace", + "title": "WHOIS", "type": "object" }, - "transformation_info": { + "key_value_object": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "value" ] }, { "required": [ - "uid" + "values" ] } ], "properties": { - "lang": { - "title": "Language", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "value": { + "title": "Value", "type": "string" }, - "url_string": { - "title": "URL String", - "type": "string" + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" } }, - "title": "Transformation Info", + "required": [ + "name" + ], + "title": "Key:Value object", "type": "object" }, - "url": { + "metadata": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], "properties": { - "categories": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { "items": { "type": "string" }, - "title": "Website Categorization", + "title": "Debug Information", "type": "array" }, - "category_ids": { + "profiles": { "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" + "type": "string" }, - "title": "Website Categorization IDs", + "title": "Profiles", "type": "array" }, - "domain": { - "title": "Domain", + "log_provider": { + "title": "Log Provider", "type": "string" }, - "hostname": { - "title": "Hostname", + "event_code": { + "title": "Event Code", "type": "string" }, - "path": { - "title": "Path", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", "type": "string" }, - "port": { - "title": "Port", + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", "type": "integer" }, - "query_string": { - "title": "HTTP Query String", + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", "type": "string" }, - "resource_type": { - "title": "Resource Type", + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "scheme": { - "title": "Scheme", + "name": { + "title": "Name", "type": "string" }, - "subdomain": { - "title": "Subdomain", + "type": { + "title": "Type", "type": "string" }, - "url_string": { - "title": "URL String", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Uniform Resource Locator", + "required": [ + "uid" + ], + "title": "Node", "type": "object" }, - "user": { + "product": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "account" - ] - }, { "required": [ "name" @@ -7347,549 +7282,614 @@ } ], "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "display_name": { - "title": "Display Name", + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", "type": "string" }, - "domain": { - "title": "Domain", + "name": { + "title": "Name", "type": "string" }, - "email_addr": { - "title": "Email Address", + "path": { + "title": "Path", "type": "string" }, - "forward_addr": { - "title": "Forwarding Address", + "uid": { + "title": "Unique ID", "type": "string" }, - "full_name": { - "title": "Full Name", + "url_string": { + "title": "URL String", "type": "string" }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" + "vendor_name": { + "title": "Vendor Name", + "type": "string" }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" + "bulletin": { + "title": "Patch Bulletin", + "type": "string" }, - "name": { - "title": "Name", + "classification": { + "title": "Classification", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "phone_number": { - "title": "Telephone Number", + "desc": { + "title": "Description", "type": "string" }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", + "install_state": { + "title": "Install State", "type": "string" }, - "risk_level_id": { + "install_state_id": { "enum": [ 0, 1, 2, 3, - 4, 99 ], - "title": "Risk Level ID", + "title": "Install State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", "type": "integer" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", "type": "string" } }, - "title": "User", + "required": [ + "uid" + ], + "title": "Advisory", "type": "object" }, - "vulnerability": { + "network_endpoint": { "additionalProperties": false, - "oneOf": [ + "anyOf": [ { - "not": { - "required": [ - "cve", - "cwe" - ] - }, "required": [ - "advisory" + "domain" ] }, { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, "required": [ - "cve" + "hostname" ] }, { - "not": { - "required": [ - "advisory", - "cve" - ] - }, "required": [ - "cwe" + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" ] } ], "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { + "agent_list": { "items": { - "$ref": "#/$defs/affected_code" + "$ref": "#/$defs/agent" }, - "title": "Affected Code", + "title": "Agent List", "type": "array" }, - "affected_packages": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { "items": { - "$ref": "#/$defs/affected_package" + "$ref": "#/$defs/fingerprint" }, - "title": "Affected Software Packages", + "title": "Fingerprints", "type": "array" }, - "category": { - "title": "Category", + "hostname": { + "title": "Hostname", "type": "string" }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "instance_uid": { + "title": "Instance ID", + "type": "string" }, - "dependency_chain": { - "title": "Dependency Chain", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "desc": { - "title": "Description", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" }, - "exploit_ref_url": { - "title": "Exploit URL", + "ip": { + "title": "IP Address", "type": "string" }, - "exploit_requirement": { - "title": "Exploit Requirement", + "isp": { + "title": "ISP Name", "type": "string" }, - "exploit_type": { - "title": "Exploit Type", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" + "mac": { + "title": "MAC Address", + "type": "string" }, - "fix_coverage": { - "title": "Fix Coverage", + "mac_vendor": { + "title": "MAC Vendor", "type": "string" }, - "fix_coverage_id": { + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { "enum": [ 0, 1, 2, - 3, 99 ], - "title": "Fix Coverage ID", + "title": "Network Scope ID", "type": "integer" }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "last_seen_time": { - "title": "Last Seen", + "port": { + "title": "Port", "type": "integer" }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" + "svc_name": { + "title": "Service Name", + "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "type": { + "title": "Type", + "type": "string" }, - "severity": { - "title": "Severity", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", "type": "string" }, - "title": { - "title": "Title", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", "type": "string" } }, - "title": "Vulnerability Details", + "title": "Network Endpoint", "type": "object" }, - "whois": { + "d3f_tactic": { "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, - "dnssec_status": { - "title": "DNSSEC Status", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "domain": { - "title": "Domain", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" }, - "domain_contacts": { + "cvss": { "items": { - "$ref": "#/$defs/domain_contact" + "$ref": "#/$defs/cvss" }, - "title": "Domain Contacts", + "title": "CVSS Score", "type": "array" }, - "email_addr": { - "title": "Registrar Abuse Email Address", + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", "type": "string" }, - "isp": { - "title": "ISP Name", + "cwe_url": { + "title": "CWE URL", "type": "string" }, - "isp_org": { - "title": "ISP Org", + "desc": { + "title": "Description", "type": "string" }, - "last_seen_time": { - "title": "Last Updated At", + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "name_servers": { + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { "items": { "type": "string" }, - "title": "Name Servers", + "title": "References", "type": "array" }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" }, - "registrar": { - "title": "Domain Registrar", + "title": { + "title": "Title", "type": "string" }, - "status": { - "title": "Domain Status", + "type": { + "title": "Vulnerability Type", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", + "uid": { + "title": "CVE ID", "type": "string" } }, - "title": "WHOIS", + "required": [ + "uid" + ], + "title": "CVE", "type": "object" }, - "win_win_service": { + "domain_contact": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" }, - { - "required": [ - "service_category_id" - ] + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" }, - { - "required": [ - "service_dependencies" - ] + "name": { + "title": "Name", + "type": "string" }, - { - "required": [ - "service_error_control_id" - ] + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "service_start_name" + "name" ] }, { "required": [ - "service_start_type_id" + "type" ] }, { "required": [ - "service_type_id" + "uid" ] } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" + "data": { + "title": "Data" }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" + "desc": { + "title": "Description", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" + "is_applied": { + "title": "Applied", + "type": "boolean" }, "name": { "title": "Name", "type": "string" }, - "service_category": { - "title": "Service Category", + "type": { + "title": "Type", "type": "string" }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", + "uid": { + "title": "Unique ID", "type": "string" }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" + "end_time": { + "title": "End Time", + "type": "integer" }, - "service_start_name": { - "title": "Service Start Name", + "message": { + "title": "Message", "type": "string" }, - "service_start_type": { - "title": "Service Start Type", + "operation": { + "title": "Operation", "type": "string" }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "status_code": { + "title": "Status Code", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "name" + "end_time", + "start_time", + "uid" ], - "title": "Windows Service", + "title": "Span", "type": "object" } }, @@ -7897,72 +7897,107 @@ "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Activity ID", - "type": "integer" + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" }, - "activity_name": { - "title": "Activity", + "message": { + "title": "Message", "type": "string" }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" }, - "ai_model": { - "$ref": "#/$defs/ai_model", - "title": "AI Model" + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" }, "api": { "$ref": "#/$defs/api", "title": "API Details" }, - "category_name": { - "title": "Category", - "type": "string" + "message_context": { + "$ref": "#/$defs/message_context", + "title": "Message Context" }, - "category_uid": { - "const": 6, - "title": "Category ID", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "class_name": { - "title": "Class", + "status_detail": { + "title": "Status Detail", "type": "string" }, - "class_uid": { - "const": 6003, - "title": "Class ID", + "status_code": { + "title": "Status Code", + "type": "string" + }, + "type_name": { + "title": "Type Name", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", "type": "integer" }, - "count": { - "title": "Count", + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", "type": "integer" }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "status": { + "title": "Status", + "type": "string" }, - "end_time": { - "title": "End Time", + "ai_model": { + "$ref": "#/$defs/ai_model", + "title": "AI Model" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", "type": "integer" }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, "enrichments": { "items": { "$ref": "#/$defs/enrichment" @@ -7974,52 +8009,51 @@ "$ref": "#/$defs/http_request", "title": "HTTP Request" }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" - }, - "message": { - "title": "Message", - "type": "string" + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" }, - "message_context": { - "$ref": "#/$defs/message_context", - "title": "Message Context" + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" + "activity_name": { + "title": "Activity", + "type": "string" }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "raw_data": { - "title": "Raw Data", + "class_name": { + "title": "Class", "type": "string" }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" }, "raw_data_size": { "title": "Raw Data Size", "type": "integer" }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Resources Array", - "type": "array" + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, "severity": { "title": "Severity", "type": "string" }, + "category_name": { + "title": "Category", + "type": "string" + }, "severity_id": { "enum": [ 0, @@ -8034,59 +8068,25 @@ "title": "Severity ID", "type": "integer" }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", + "count": { + "title": "Count", "type": "integer" }, - "timezone_offset": { - "title": "Timezone Offset", + "end_time": { + "title": "End Time", "type": "integer" }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, "type_uid": { "title": "Type ID", "type": "integer" }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" } }, "required": [ diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json index 2618bbd2e5..f982941183 100644 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+security_control+trace.json @@ -1,11 +1,11 @@ { "$defs": { - "account": { + "kb_article": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "src_url" ] }, { @@ -14,152 +14,6 @@ ] } ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, "properties": { "avg_timespan": { "$ref": "#/$defs/timespan", @@ -177,10 +31,6 @@ "title": "Created Time", "type": "integer" }, - "desc": { - "title": "Description", - "type": "string" - }, "install_state": { "title": "Install State", "type": "string" @@ -200,10 +50,6 @@ "title": "The patch is superseded.", "type": "boolean" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "os": { "$ref": "#/$defs/os", "title": "OS" @@ -212,26 +58,9 @@ "$ref": "#/$defs/product", "title": "Product" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, "size": { "title": "Size", @@ -246,247 +75,238 @@ "type": "string" }, "uid": { - "title": "Advisory ID", + "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Advisory", + "title": "KB Article", "type": "object" }, - "affected_code": { + "long_string": { "additionalProperties": false, "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "start_column": { - "title": "Start Column", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "file" + "value" ], - "title": "Affected Code", + "title": "Long String", "type": "object" }, - "affected_package": { + "enrichment": { "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpe_name": { - "title": "The product CPE identifier", + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "fixed_in_version": { - "title": "Fixed In Version", + "provider": { + "title": "Provider", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "license": { - "title": "Software License", + "short_desc": { + "title": "Short Description", "type": "string" }, - "license_url": { - "title": "Software License URL", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "type": { + "title": "Type", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", "type": "string" }, - "path": { - "title": "Path", + "display_name": { + "title": "Display Name", "type": "string" }, - "purl": { - "title": "Package URL", + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", "type": "string" }, - "release": { - "title": "Software Release Details", + "given_name": { + "title": "Given Name", "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "hire_time": { + "title": "Hire Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "job_title": { + "title": "Job Title", "type": "string" }, - "type": { - "title": "Type", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", "type": "integer" }, - "uid": { - "title": "Package UID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "version": { - "title": "Version", + "surname": { + "title": "Surname", "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" } }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", + "title": "LDAP Person", "type": "object" }, - "agent": { + "email_auth": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Agent Name", + "dkim": { + "title": "DKIM Status", "type": "string" }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", + "dkim_domain": { + "title": "DKIM Domain", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" }, - "uid": { - "title": "Agent ID", + "dmarc": { + "title": "DMARC Status", "type": "string" }, - "uid_alt": { - "title": "Alternate Agent ID", + "dmarc_override": { + "title": "DMARC Override", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "dmarc_policy": { + "title": "DMARC Policy", "type": "string" }, - "version": { - "title": "Agent Version", + "spf": { + "title": "SPF Status", "type": "string" } }, - "title": "Agent", + "title": "Email Authentication", "type": "object" }, - "ai_model": { + "epss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "ai_provider": { - "title": "AI Provider", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "percentile": { + "title": "EPSS Percentile", + "type": "number" }, - "uid": { - "title": "Unique ID", + "score": { + "title": "EPPS Score", "type": "string" }, "version": { @@ -495,54 +315,35 @@ } }, "required": [ - "ai_provider" + "score" ], - "title": "AI Model", + "title": "EPSS", "type": "object" }, - "analytic": { + "device_hw_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", + "bios_manufacturer": { + "title": "BIOS Manufacturer", "type": "string" }, - "desc": { - "title": "Description", + "bios_ver": { + "title": "BIOS Version", "type": "string" }, - "name": { - "title": "Name", + "chassis": { + "title": "Chassis", "type": "string" }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", + "cpu_architecture": { + "title": "CPU Architecture", "type": "string" }, - "state_id": { + "cpu_architecture_id": { "enum": [ 0, 1, @@ -550,93 +351,111 @@ 3, 99 ], - "title": "State ID", + "title": "CPU Architecture ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", + "cpu_cores": { + "title": "CPU Cores", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "cpu_count": { + "title": "CPU Count", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" }, - "operation": { - "title": "Operation", + "cpu_type": { + "title": "Processor Type", "type": "string" }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" + "gpu_count": { + "title": "GPU Count", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" }, - "version": { - "title": "Version", + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "required": [ - "operation" - ], - "title": "API", + "title": "Device Hardware Info", "type": "object" }, - "application": { + "network_proxy": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -644,166 +463,89 @@ } ], "properties": { - "criticality": { - "title": "Business Criticality", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Application Description", + "uid": { + "title": "Unique ID", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "hostname": { - "title": "Hostname", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "name": { - "title": "Application Name", + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Application Relationship" + "instance_uid": { + "title": "Instance ID", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "mac": { + "title": "MAC Address", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "sbom": { - "$ref": "#/$defs/sbom", - "title": "Related SBOM" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Application Type", - "type": "string" - }, - "uid": { - "title": "Application ID", + "isp": { + "title": "ISP Name", "type": "string" }, - "uid_alt": { - "title": "Application Alternative ID", + "zone": { + "title": "Network Zone", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Application Version", + "name": { + "title": "Name", "type": "string" - } - }, - "title": "Application", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" }, - "email_addr": { - "title": "Email Address", - "type": "string" + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - "factor_type": { - "title": "Factor Type", + "svc_name": { + "title": "Service Name", "type": "string" }, - "factor_type_id": { + "type_id": { "enum": [ 0, 1, @@ -817,107 +559,37 @@ 9, 10, 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Factor Type ID", + "title": "Type ID", "type": "integer" }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", + "network_scope": { + "title": "Network Scope", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "security_questions": { + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { "items": { "type": "string" }, - "title": "Security Questions", + "title": "Intermediate IP Addresses", "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + "isp_org": { + "title": "ISP Org", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" }, "fingerprints": { "items": { @@ -926,128 +598,199 @@ "title": "Fingerprints", "type": "array" }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" + "vpc_uid": { + "title": "VPC UID", + "type": "string" }, - "issuer": { - "title": "Issuer Distinguished Name", + "domain": { + "title": "Domain", "type": "string" }, - "sans": { + "agent_list": { "items": { - "$ref": "#/$defs/san" + "$ref": "#/$defs/agent" }, - "title": "Subject Alternative Names", + "title": "Agent List", "type": "array" }, - "serial_number": { - "title": "Certificate Serial Number", + "ip": { + "title": "IP Address", "type": "string" }, - "subject": { - "title": "Subject Distinguished Name", + "hostname": { + "title": "Hostname", "type": "string" }, - "uid": { - "title": "Unique ID", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "version": { - "title": "Version", + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", + "title": "Network Proxy Endpoint", "type": "object" }, - "cis_control": { + "data_classification": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], "properties": { - "desc": { - "title": "Description", + "category": { + "title": "Category", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" }, - "version": { - "title": "Version", + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", + "status": { + "title": "Status", "type": "string" }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "required": [ - "type" - ], - "title": "Classifier Details", + "title": "Data Classification", "type": "object" }, - "cloud": { + "http_response": { "additionalProperties": false, "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" + "body_length": { + "title": "Response Body Length", + "type": "integer" }, - "cloud_partition": { - "title": "Cloud Partition", + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "project_uid": { - "title": "Project ID", - "type": "string" + "latency": { + "title": "Latency", + "type": "integer" }, - "provider": { - "title": "Cloud Provider", - "type": "string" + "length": { + "title": "Response Length", + "type": "integer" }, - "region": { - "title": "Region", + "message": { + "title": "Message", "type": "string" }, - "zone": { - "title": "Cloud Availability Zone", + "status": { + "title": "Status", "type": "string" } }, "required": [ - "provider" + "code" ], - "title": "Cloud", + "title": "HTTP Response", "type": "object" }, - "container": { + "resource_details": { "additionalProperties": false, "anyOf": [ { @@ -1062,13 +805,39 @@ } ], "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" }, "labels": { "items": { @@ -1077,34 +846,42 @@ "title": "Labels", "type": "array" }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "network_driver": { - "title": "Network Driver", + "namespace": { + "title": "Namespace", "type": "string" }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" }, - "runtime": { - "title": "Runtime", + "role": { + "title": "Role", "type": "string" }, - "size": { - "title": "Size", + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", "type": "integer" }, - "tag": { - "title": "Image Tag", - "type": "string" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -1112,279 +889,384 @@ "title": "Tags", "type": "array" }, + "type": { + "title": "Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" - } - }, - "title": "Container", + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", "type": "object" }, - "cve": { + "display": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "color_depth": { + "title": "Color Depth", "type": "integer" }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" + "physical_height": { + "title": "Physical Height", + "type": "integer" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" + "physical_width": { + "title": "Physical Width", + "type": "integer" }, - "cwe_url": { - "title": "CWE URL", + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "desc": { - "title": "Description", + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", "type": "string" }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "name": { + "title": "Name", + "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "protocol_name": { + "title": "Supported Protocol", + "type": "string" }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "rate_limit": { + "title": "Rate Limit", + "type": "integer" }, - "title": { - "title": "Title", - "type": "string" + "scim_group_schema": { + "title": "SCIM Group Schema" }, - "type": { - "title": "Vulnerability Type", - "type": "string" + "scim_user_schema": { + "title": "SCIM User Schema" }, - "uid": { - "title": "CVE ID", + "state": { + "title": "State", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" }, - "depth": { + "state_id": { "enum": [ - "Base", - "Environmental", - "Temporal" + 0, + 1, + 2, + 3, + 4, + 99 ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" + "title": "State ID", + "type": "integer" }, - "severity": { - "title": "Severity", + "uid": { + "title": "Unique ID", "type": "string" }, - "src_url": { - "title": "Source URL", + "uid_alt": { + "title": "External ID", "type": "string" }, - "vector_string": { - "title": "Vector String", + "url_string": { + "title": "SCIM Endpoint URL", "type": "string" }, "vendor_name": { - "title": "Vendor Name", + "title": "Service Provider", "type": "string" }, "version": { - "title": "Version", + "title": "SCIM Version", "type": "string" } }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", + "title": "SCIM", "type": "object" }, - "cwe": { + "programmatic_credential": { "additionalProperties": false, "properties": { - "caption": { - "title": "Caption", - "type": "string" + "last_used_time": { + "title": "Last Used Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "type": { + "title": "Type", "type": "string" }, "uid": { - "title": "CWE ID", + "title": "Unique ID", "type": "string" } }, "required": [ "uid" ], - "title": "CWE", + "title": "Programmatic Credential", "type": "object" }, - "d3f_tactic": { + "os": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "build": { + "title": "OS Build", "type": "string" }, - "src_url": { - "title": "Source URL", + "country": { + "title": "Country", "type": "string" }, - "uid": { - "title": "Unique ID", + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "sp_name": { + "title": "OS Service Pack", "type": "string" }, - "uid": { - "title": "Unique ID", + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "MITRE D3FEND\u2122 Technique", + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", "type": "object" }, - "d3fend": { + "tactic": { "additionalProperties": false, "anyOf": [ { "required": [ - "d3f_tactic" + "name" ] }, { "required": [ - "d3f_technique" + "uid" ] } ], "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" + "name": { + "title": "Name", + "type": "string" }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" + "src_url": { + "title": "Source URL", + "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "MITRE D3FEND\u2122", + "title": "MITRE Tactic", "type": "object" }, - "data_classification": { + "dns_answer": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" }, - { - "required": [ - "confidentiality_id" - ] + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" } + }, + "required": [ + "rdata" ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, "properties": { - "category": { - "title": "Category", + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", "type": "string" }, - "category_id": { + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { "enum": [ 0, 1, @@ -1393,114 +1275,247 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, 99 ], - "title": "Category ID", + "title": "Auth Protocol ID", "type": "integer" }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "duration_mins": { + "title": "SSO Session Duration", "type": "integer" }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" }, - "size": { - "title": "Size", + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "src_url": { - "title": "Source URL", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "status_details": { + "scopes": { "items": { "type": "string" }, - "title": "Status Details", + "title": "Scopes", "type": "array" }, - "status_id": { - "enum": [ - 0, - 1, - 2, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Data Classification", + "title": "Token", "type": "object" }, - "device": { + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "d3f_tactic" ] }, { "required": [ - "instance_uid" + "d3f_technique" ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" }, - { - "required": [ - "interface_name" - ] + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" }, - { - "required": [ - "interface_uid" - ] + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" }, - { - "required": [ - "ip" - ] + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ { "required": [ "name" @@ -1513,207 +1528,192 @@ } ], "properties": { - "agent_list": { + "countermeasures": { "items": { - "$ref": "#/$defs/agent" + "$ref": "#/$defs/d3fend" }, - "title": "Agent List", + "title": "Countermeasures", "type": "array" }, - "autoscale_uid": { - "title": "Autoscale UID", + "name": { + "title": "Name", "type": "string" }, - "boot_time": { - "title": "Boot Time", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "boot_uid": { - "title": "Boot UID", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + { + "required": [ + "country" + ] }, - "created_time": { - "title": "Created Time", - "type": "integer" + { + "required": [ + "postal_code" + ] }, - "desc": { - "title": "Description", + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", "type": "string" }, - "domain": { - "title": "Domain", + "city": { + "title": "City", "type": "string" }, - "eid": { - "title": "EID", + "continent": { + "title": "Continent", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { + "coordinates": { "items": { - "$ref": "#/$defs/group" + "type": "number" }, - "title": "Groups", + "title": "Coordinates", "type": "array" }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", + "country": { + "title": "Country", "type": "string" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", + "desc": { + "title": "Description", "type": "string" }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", + "geodetic_altitude": { + "title": "Geodetic Altitude", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "geohash": { + "title": "Geohash", "type": "string" }, - "ip": { - "title": "IP Address", + "horizontal_accuracy": { + "title": "Horizontal Accuracy", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", + "is_on_premises": { + "title": "On-Premises", "type": "boolean" }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "isp": { + "title": "ISP Name", + "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + "lat": { + "title": "Latitude", + "type": "number" }, - "mac": { - "title": "MAC Address", - "type": "string" + "long": { + "title": "Longitude", + "type": "number" }, - "mac_vendor": { - "title": "MAC Vendor", + "postal_code": { + "title": "Postal Code", "type": "string" }, - "meid": { - "title": "MEID", + "pressure_altitude": { + "title": "Pressure Altitude", "type": "string" }, - "model": { - "title": "Model", + "provider": { + "title": "Provider", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", + "region": { + "title": "Region", "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { "items": { - "$ref": "#/$defs/network_interface" + "$ref": "#/$defs/auth_factor" }, - "title": "Network Interfaces", + "title": "Authentication Factors", "type": "array" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "domain": { + "title": "Domain", + "type": "string" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "issuer": { + "title": "Issuer Details", + "type": "string" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "name": { + "title": "Name", + "type": "string" }, - "region": { - "title": "Region", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "risk_level": { - "title": "Risk Level", + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", "type": "string" }, - "risk_level_id": { + "state_id": { "enum": [ 0, 1, @@ -1722,26 +1722,45 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "subnet": { - "title": "Subnet", + "uid": { + "title": "Unique ID", "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "url_string": { + "title": "Configuration URL", "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] }, - "type": { - "title": "Type", + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", "type": "string" }, - "type_id": { + "ai_role_id": { "enum": [ 0, 1, @@ -1750,748 +1769,490 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "AI Role ID", "type": "integer" }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" + "application": { + "$ref": "#/$defs/application", + "title": "Application" }, - "uid": { - "title": "Unique ID", - "type": "string" + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" }, - "uid_alt": { - "title": "Alternate ID", + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "total_tokens": { + "title": "Total Tokens", + "type": "integer" }, - "zone": { - "title": "Network Zone", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Device", + "title": "Message Context", "type": "object" }, - "device_hw_info": { + "process": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "chassis": { - "title": "Chassis", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "cpu_architecture": { - "title": "CPU Architecture", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", "type": "string" }, - "cpu_architecture_id": { + "integrity_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, 99 ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", + "title": "Integrity Level", "type": "integer" }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" }, - "cpu_type": { - "title": "Processor Type", + "name": { + "title": "Name", "type": "string" }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" + "path": { + "title": "Path", + "type": "string" }, - "ram_size": { - "title": "RAM Size", + "pid": { + "title": "Process ID", "type": "integer" }, - "serial_number": { - "title": "Serial Number", - "type": "string" + "ptid": { + "title": "Process Thread ID", + "type": "integer" }, - "uuid": { - "title": "UUID", + "sandbox": { + "title": "Sandbox", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", + "terminated_time": { + "title": "Terminated Time", "type": "integer" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", + "tid": { + "title": "Thread ID", "type": "integer" }, - "developer_uid": { - "title": "Developer UID", + "uid": { + "title": "Unique ID", "type": "string" }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" + "user": { + "$ref": "#/$defs/user", + "title": "User" }, - "state": { - "title": "State", + "working_directory": { + "title": "Working Directory", "type": "string" }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" } }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", + "title": "Process", "type": "object" }, - "discovery_details": { + "vulnerability": { "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "edge": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, + "oneOf": [ { + "not": { + "required": [ + "cve", + "cwe" + ] + }, "required": [ - "uid" + "advisory" ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "relation": { - "title": "Relation", - "type": "string" - }, - "source": { - "title": "Source", - "type": "string" }, - "target": { - "title": "Target", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "source", - "target" - ], - "title": "Edge", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, "required": [ - "from" + "cve" ] }, { + "not": { + "required": [ + "advisory", + "cve" + ] + }, "required": [ - "to" + "cwe" ] } ], "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" }, - "from_mailboxes": { + "affected_code": { "items": { - "type": "string" + "$ref": "#/$defs/affected_code" }, - "title": "From Mailboxes", + "title": "Affected Code", "type": "array" }, - "http_headers": { + "affected_packages": { "items": { - "$ref": "#/$defs/http_header" + "$ref": "#/$defs/affected_package" }, - "title": "HTTP Headers", + "title": "Affected Software Packages", "type": "array" }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", + "category": { + "title": "Category", "type": "string" }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" }, - "return_path": { - "title": "Return Path", - "type": "string" + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" }, - "sender": { - "title": "Sender", + "dependency_chain": { + "title": "Dependency Chain", "type": "string" }, - "sender_mailbox": { - "title": "Sender Mailbox", + "desc": { + "title": "Description", "type": "string" }, - "size": { - "title": "Size", + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", "type": "integer" }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", + "exploit_ref_url": { + "title": "Exploit URL", "type": "string" }, - "dkim_signature": { - "title": "DKIM Signature", + "exploit_requirement": { + "title": "Exploit Requirement", "type": "string" }, - "dmarc": { - "title": "DMARC Status", + "exploit_type": { + "title": "Exploit Type", "type": "string" }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" + "first_seen_time": { + "title": "First Seen", + "type": "integer" }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" + "fix_available": { + "title": "Fix Availability", + "type": "boolean" }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", + "fix_coverage": { + "title": "Fix Coverage", "type": "string" }, - "algorithm_id": { + "fix_coverage_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, - 6, 99 ], - "title": "Encryption Algorithm ID", + "title": "Fix Coverage ID", "type": "integer" }, - "key_length": { - "title": "Encryption Key Length", + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", "type": "integer" }, - "key_uid": { - "title": "Key UID", + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", "type": "string" }, - "type": { - "title": "Encryption Type", + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "title": "Encryption Details", + "title": "Vulnerability Details", "type": "object" }, - "enrichment": { + "affected_code": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "end_column": { + "title": "End Column", "type": "integer" }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" + "end_line": { + "title": "End Line", + "type": "integer" }, - "provider": { - "title": "Provider", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "short_desc": { - "title": "Short Description", - "type": "string" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "src_url": { - "title": "Source URL", - "type": "string" + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" }, - "type": { - "title": "Type", - "type": "string" + "start_column": { + "title": "Start Column", + "type": "integer" }, - "value": { - "title": "Value", - "type": "string" + "start_line": { + "title": "Start Line", + "type": "integer" } }, "required": [ - "data", - "name", - "value" + "file" ], - "title": "Enrichment", + "title": "Affected Code", "type": "object" }, - "environment_variable": { + "keyboard_info": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", "type": "string" }, - "value": { - "title": "Value", + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", "type": "string" } }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", + "title": "Keyboard Information", "type": "object" }, - "epss": { + "certificate": { "additionalProperties": false, "properties": { "created_time": { "title": "Created Time", "type": "integer" }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - "score": { - "title": "EPPS Score", + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", + "type": "string" + }, + "subject": { + "title": "Subject Distinguished Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", "type": "string" }, "version": { @@ -2500,12 +2261,13 @@ } }, "required": [ - "score" + "issuer", + "serial_number" ], - "title": "EPSS", + "title": "Digital Certificate", "type": "object" }, - "extension": { + "graph": { "additionalProperties": false, "anyOf": [ { @@ -2520,26 +2282,67 @@ } ], "properties": { + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, "name": { "title": "Name", "type": "string" }, + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" + }, + "query_language": { + "title": "Query Language", + "type": "string" + }, + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "version" + "nodes" ], - "title": "Schema Extension", + "title": "Graph", "type": "object" }, - "feature": { + "account": { "additionalProperties": false, "anyOf": [ { @@ -2554,76 +2357,41 @@ } ], "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" + "is_disabled": { + "title": "Disabled", + "type": "boolean" }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" + "is_locked": { + "title": "Locked", + "type": "boolean" }, - "attributes": { - "title": "Attributes", - "type": "integer" + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" }, - "company_name": { - "title": "Company Name", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "confidentiality": { - "title": "Confidentiality", + "name": { + "title": "Name", "type": "string" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "drive_type": { - "title": "Drive Type", + "type": { + "title": "Type", "type": "string" }, - "drive_type_id": { + "type_id": { "enum": [ 0, 1, @@ -2631,211 +2399,228 @@ 3, 4, 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, 99 ], - "title": "Drive Type ID", + "title": "Type ID", "type": "integer" }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", + "uid": { + "title": "Unique ID", "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", "type": "string" }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "mime_type": { - "title": "MIME type", + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "modified_time": { - "title": "Modified Time", + "number": { + "title": "Number", "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { "name": { "title": "Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", + "type": { + "title": "Type", "type": "string" }, - "path": { - "title": "Path", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "security_descriptor": { - "title": "Security Descriptor", + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" + "expiration_reason": { + "title": "Expiration Reason", + "type": "string" }, - "size": { - "title": "Size", + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" }, - "type": { - "title": "Type", + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" + "terminal": { + "title": "Terminal", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" }, - "uri": { - "title": "File URI", + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "version": { - "title": "Version", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "volume": { - "title": "Volume", + "src_url": { + "title": "Source URL", "type": "string" }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" + "uid": { + "title": "Unique ID", + "type": "string" } }, - "required": [ - "name", - "type_id" - ], - "title": "File", + "title": "MITRE D3FEND\u2122 Technique", "type": "object" }, - "fingerprint": { + "image": { "additionalProperties": false, "properties": { - "algorithm": { - "title": "Algorithm", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "path": { + "title": "Path", + "type": "string" }, - "value": { - "title": "Value", + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "algorithm_id", - "value" + "uid" ], - "title": "Fingerprint", + "title": "Image", "type": "object" }, - "firewall_rule": { + "application": { "additionalProperties": false, "anyOf": [ { @@ -2850,163 +2635,130 @@ } ], "properties": { - "category": { - "title": "Category", + "criticality": { + "title": "Business Criticality", "type": "string" }, - "condition": { - "title": "Condition", - "type": "string" + "data": { + "title": "Data" }, "desc": { - "title": "Description", + "title": "Application Description", "type": "string" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "match_details": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { "items": { "type": "string" }, - "title": "Match Details", + "title": "Labels", "type": "array" }, - "match_location": { - "title": "Match Location", - "type": "string" - }, "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", + "title": "Application Name", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "uid": { - "title": "Unique ID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "bus_type_id": { + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, - 7, 99 ], - "title": "Bus Type ID", + "title": "Risk Level ID", "type": "integer" }, - "cores": { - "title": "Cores", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "model": { - "title": "Model", + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "uid": { + "title": "Application ID", "type": "string" }, - "vram_mode": { - "title": "VRAM Mode", + "uid_alt": { + "title": "Application Alternative ID", "type": "string" }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" + "version": { + "title": "Application Version", + "type": "string" } }, - "title": "GPU Information", + "title": "Application", "type": "object" }, - "graph": { + "script": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "desc": { - "title": "Description", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "edges": { + "hashes": { "items": { - "$ref": "#/$defs/edge" + "$ref": "#/$defs/fingerprint" }, - "title": "Edges", + "title": "Hashes", "type": "array" }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, "name": { "title": "Name", "type": "string" }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" }, - "query_language": { - "title": "Query Language", + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", "type": "string" }, - "query_language_id": { + "type_id": { "enum": [ 0, 1, @@ -3018,207 +2770,141 @@ 7, 99 ], - "title": "Query Language ID", + "title": "Type ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" } }, "required": [ - "nodes" + "script_content", + "type_id" ], - "title": "Graph", + "title": "Script", "type": "object" }, - "group": { + "affected_package": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "desc": { - "title": "Description", + "architecture": { + "title": "Architecture", "type": "string" }, - "domain": { - "title": "Domain", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "name": { - "title": "Name", + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", "type": "string" }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "type": { - "title": "Group Type", + "license": { + "title": "Software License", "type": "string" }, - "uid": { - "title": "Unique ID", + "license_url": { + "title": "Software License URL", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "http_request": { - "additionalProperties": false, - "properties": { - "args": { - "title": "HTTP Arguments", + "package_manager": { + "title": "Package Manager", "type": "string" }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", + "package_manager_url": { + "title": "Package Manager URL", "type": "string" }, - "length": { - "title": "Request Length", - "type": "integer" + "path": { + "title": "Path", + "type": "string" }, - "referrer": { - "title": "HTTP Referrer", + "purl": { + "title": "Package URL", "type": "string" }, - "uid": { - "title": "Unique ID", + "release": { + "title": "Software Release Details", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "user_agent": { - "title": "HTTP User-Agent", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "HTTP Version", + "type": { + "title": "Type", "type": "string" }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" - } - }, - "title": "HTTP Request", - "type": "object" - }, - "http_response": { - "additionalProperties": false, - "properties": { - "body_length": { - "title": "Response Body Length", - "type": "integer" - }, - "code": { - "title": "Response Code", + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", "type": "integer" }, - "content_type": { - "title": "HTTP Content Type", + "uid": { + "title": "Package UID", "type": "string" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" + "vendor_name": { + "title": "Vendor Name", + "type": "string" }, - "length": { - "title": "Response Length", - "type": "integer" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", + "type": "object" + }, + "cis_control": { + "additionalProperties": false, + "properties": { + "desc": { + "title": "Description", + "type": "string" }, - "message": { - "title": "Message", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "version": { + "title": "Version", "type": "string" } }, "required": [ - "code" + "name" ], - "title": "HTTP Response", + "title": "CIS Control", "type": "object" }, - "idp": { + "analytic": { "additionalProperties": false, "anyOf": [ { @@ -3233,44 +2919,28 @@ } ], "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" + "category": { + "title": "Category", + "type": "string" }, - "issuer": { - "title": "Issuer Details", + "desc": { + "title": "Description", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" }, "state": { "title": "State", @@ -3282,222 +2952,306 @@ 1, 2, 3, - 4, 99 ], "title": "State ID", "type": "integer" }, - "tenant_uid": { - "title": "Tenant UID", + "type": { + "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" }, - "url_string": { - "title": "Configuration URL", + "version": { + "title": "Version", "type": "string" } }, - "title": "Identity Provider", + "required": [ + "type_id" + ], + "title": "Analytic", "type": "object" }, - "image": { + "edge": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "labels": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "relation": { + "title": "Relation", + "type": "string" + }, + "source": { + "title": "Source", + "type": "string" + }, + "target": { + "title": "Target", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "source", + "target" + ], + "title": "Edge", + "type": "object" + }, + "actor": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "app_name" + ] + }, + { + "required": [ + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" + ] + } + ], + "properties": { + "app_name": { + "title": "Application Name", + "type": "string" + }, + "app_uid": { + "title": "Application ID", + "type": "string" + }, + "authorizations": { "items": { - "type": "string" + "$ref": "#/$defs/authorization" }, - "title": "Labels", + "title": "Authorization Information", "type": "array" }, - "name": { - "title": "Name", + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", "type": "string" }, - "path": { - "title": "Path", + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "cloud_partition": { + "title": "Cloud Partition", "type": "string" }, - "tag": { - "title": "Image Tag", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", + "type": "string" + }, + "provider": { + "title": "Cloud Provider", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "region": { + "title": "Region", + "type": "string" }, - "uid": { - "title": "Unique ID", + "zone": { + "title": "Cloud Availability Zone", "type": "string" } }, "required": [ - "uid" + "provider" ], - "title": "Image", + "title": "Cloud", "type": "object" }, - "kb_article": { + "trace": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", + "end_time": { + "title": "End Time", "type": "integer" }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "severity": { - "title": "Severity", - "type": "string" + "span": { + "$ref": "#/$defs/span", + "title": "Span" }, - "size": { - "title": "Size", + "start_time": { + "title": "Start Time", "type": "integer" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "KB Article", + "required": [ + "uid" + ], + "title": "Trace", "type": "object" }, - "key_value_object": { + "ai_model": { "additionalProperties": false, "anyOf": [ { "required": [ - "value" + "name" ] }, { "required": [ - "values" + "uid" ] } ], "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "name" + "ai_provider" ], - "title": "Key:Value object", + "title": "AI Model", "type": "object" }, - "keyboard_info": { + "file": { "additionalProperties": false, "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", + "parent_folder": { + "title": "Parent Folder", "type": "string" }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" + "is_system": { + "title": "System", + "type": "boolean" }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" }, - "phase_id": { + "confidentiality_id": { "enum": [ 0, 1, @@ -3506,387 +3260,280 @@ 4, 5, 6, - 7, 99 ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", + "title": "Confidentiality ID", "type": "integer" }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { + "accessor": { "$ref": "#/$defs/user", - "title": "Manager" + "title": "Accessor" + }, + "is_readonly": { + "title": "Read-Only", + "type": "boolean" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "office_location": { - "title": "Office Location", - "type": "string" + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" }, - "phone_number": { - "title": "Telephone Number", + "ext": { + "title": "File Extension", "type": "string" }, - "surname": { - "title": "Surname", + "company_name": { + "title": "Company Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] + "attributes": { + "title": "Attributes", + "type": "integer" }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", + "desc": { + "title": "Description", "type": "string" }, - "city": { - "title": "City", + "type": { + "title": "Type", "type": "string" }, - "continent": { - "title": "Continent", + "path": { + "title": "Path", "type": "string" }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", + "uri": { + "title": "File URI", "type": "string" }, - "desc": { - "title": "Description", - "type": "string" + "is_deleted": { + "title": "Deleted", + "type": "boolean" }, - "geodetic_altitude": { - "title": "Geodetic Altitude", + "confidentiality": { + "title": "Confidentiality", "type": "string" }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", + "drive_type": { + "title": "Drive Type", "type": "string" }, - "geohash": { - "title": "Geohash", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" }, - "is_on_premises": { - "title": "On-Premises", + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", "type": "boolean" }, - "isp": { - "title": "ISP Name", + "name": { + "title": "Name", "type": "string" }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" + "accessed_time": { + "title": "Accessed Time", + "type": "integer" }, - "postal_code": { - "title": "Postal Code", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "provider": { - "title": "Provider", - "type": "string" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "size": { + "title": "Size", + "type": "integer" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "event_uid": { - "title": "Event UID", + "internal_name": { + "title": "Internal Name", "type": "string" }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" }, - "log_format": { - "title": "Log Format", - "type": "string" + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" }, - "log_level": { - "title": "Log Level", + "security_descriptor": { + "title": "Security Descriptor", "type": "string" }, - "log_name": { - "title": "Log Name", + "volume": { + "title": "Volume", "type": "string" }, - "log_provider": { - "title": "Log Provider", - "type": "string" + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" }, - "log_version": { - "title": "Log Version", + "mime_type": { + "title": "MIME type", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" }, - "name": { - "title": "Name", - "type": "string" + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" }, "product": { "$ref": "#/$defs/product", "title": "Product" }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Logger", + "required": [ + "name", + "type_id" + ], + "title": "File", "type": "object" }, - "long_string": { + "remediation": { "additionalProperties": false, "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" }, - "value": { - "title": "Value", + "desc": { + "title": "Description", "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" } }, "required": [ - "value" + "desc" ], - "title": "Long String", + "title": "Remediation", "type": "object" }, - "malware": { + "email": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "from" ] }, { "required": [ - "uid" + "to" ] } ], "properties": { - "classification_ids": { + "cc": { "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" + "type": "string" }, - "title": "Classification IDs", + "title": "Cc", "type": "array" }, - "classifications": { + "cc_mailboxes": { "items": { "type": "string" }, - "title": "Classifications", + "title": "Cc Mailboxes", "type": "array" }, - "cves": { + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { "items": { - "$ref": "#/$defs/cve" + "type": "string" }, - "title": "CVE List", + "title": "Delivered To List", "type": "array" }, "files": { @@ -3896,52 +3543,152 @@ "title": "Files", "type": "array" }, - "name": { - "title": "Name", + "from": { + "title": "From", "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" }, - "path": { - "title": "Path", + "from_mailbox": { + "title": "From Mailbox", "type": "string" }, - "provider": { - "title": "Provider", + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", "type": "string" }, - "severity": { - "title": "Severity", + "raw_header": { + "title": "Raw Header", "type": "string" }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" + }, + "size": { + "title": "Size", "type": "integer" }, - "uid": { - "title": "Unique ID", + "smtp_from": { + "title": "SMTP From", + "type": "string" + }, + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", + "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", "type": "string" } }, "required": [ - "classification_ids" + "name", + "value" ], - "title": "Malware", + "title": "Environment Variable", "type": "object" }, - "malware_scan_info": { + "technique": { "additionalProperties": false, "anyOf": [ { @@ -3956,298 +3703,350 @@ } ], "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", + "src_url": { + "title": "Source URL", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, "uid": { - "title": "Scan UID", + "title": "Unique ID", "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" } }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", + "title": "MITRE Technique", "type": "object" }, - "message_context": { + "http_request": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "application" - ] - }, - { - "required": [ - "service" - ] - } - ], "properties": { - "ai_role": { - "title": "AI Role", + "args": { + "title": "HTTP Arguments", "type": "string" }, - "ai_role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "AI Role ID", + "body_length": { + "title": "Request Body Length", "type": "integer" }, - "application": { - "$ref": "#/$defs/application", - "title": "Application" - }, - "completion_tokens": { - "title": "Completion Tokens", - "type": "integer" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "name": { - "title": "Name", + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", "type": "string" }, - "prompt_tokens": { - "title": "Prompt Tokens", + "length": { + "title": "Request Length", "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "total_tokens": { - "title": "Total Tokens", - "type": "integer" + "referrer": { + "title": "HTTP Referrer", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", + "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" } }, - "title": "Message Context", + "title": "HTTP Request", "type": "object" }, - "metadata": { + "cvss": { "additionalProperties": false, "properties": { - "correlation_uid": { - "title": "Correlation UID", + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", "type": "string" }, - "debug": { + "metrics": { "items": { - "type": "string" + "$ref": "#/$defs/metric" }, - "title": "Debug Information", + "title": "Metrics", "type": "array" }, - "event_code": { - "title": "Event Code", + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", "type": "string" }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" + "src_url": { + "title": "Source URL", + "type": "string" }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" + "vector_string": { + "title": "Vector String", + "type": "string" }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "vendor_name": { + "title": "Vendor Name", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" }, - "log_format": { - "title": "Log Source Format", + "value": { + "title": "Value", "type": "string" + } + }, + "required": [ + "algorithm_id", + "value" + ], + "title": "Fingerprint", + "type": "object" + }, + "process_entity": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] }, - "log_level": { - "title": "Log Level", - "type": "string" + { + "required": [ + "cpid" + ] }, - "log_name": { - "title": "Log Name", - "type": "string" + { + "required": [ + "name" + ] }, - "log_provider": { - "title": "Log Provider", - "type": "string" + { + "required": [ + "path" + ] }, - "log_source": { - "title": "Log Source", - "type": "string" + { + "required": [ + "pid" + ] }, - "log_version": { - "title": "Log Version", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" + "cpid": { + "title": "Common Process Identifier", + "type": "string" }, - "modified_time": { - "title": "Modified Time", + "created_time": { + "title": "Created Time", "type": "integer" }, - "original_event_uid": { - "title": "Original Event ID", + "name": { + "title": "Name", "type": "string" }, - "original_time": { - "title": "Original Time", + "path": { + "title": "Path", "type": "string" }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", + "pid": { + "title": "Process ID", "type": "integer" }, - "source": { - "title": "Source", + "uid": { + "title": "Unique ID", "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", "type": "string" }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Event UID", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "untruncated_size": { - "title": "Untruncated Size", + "type_uid": { + "title": "Type ID", "type": "integer" }, - "version": { - "title": "Version", + "value": { + "title": "Value", "type": "string" } }, "required": [ - "product", - "version" + "type_id" ], - "title": "Metadata", + "title": "Observable", "type": "object" }, - "metric": { + "http_header": { "additionalProperties": false, "properties": { "name": { @@ -4263,75 +4062,68 @@ "name", "value" ], - "title": "Metric", + "title": "HTTP Header", "type": "object" }, - "mitigation": { + "attack": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "sub_technique" ] }, { "required": [ - "uid" + "tactic" + ] + }, + { + "required": [ + "technique" ] } ], "properties": { - "countermeasures": { + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" + }, + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" + }, + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" + }, + "tactics": { "items": { - "$ref": "#/$defs/d3fend" + "$ref": "#/$defs/tactic" }, - "title": "Countermeasures", + "title": "Tactics", "type": "array" }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" }, - "uid": { - "title": "Unique ID", + "version": { + "title": "Version", "type": "string" } }, - "title": "MITRE Mitigation", + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", "type": "object" }, - "network_endpoint": { + "network_interface": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "domain" - ] - }, { "required": [ "hostname" ] }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, { "required": [ "ip" @@ -4339,12 +4131,12 @@ }, { "required": [ - "name" + "mac" ] }, { "required": [ - "svc_name" + "name" ] }, { @@ -4354,133 +4146,37 @@ } ], "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, "hostname": { "title": "Hostname", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, "ip": { "title": "IP Address", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, "mac": { "title": "MAC Address", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_scope": { - "title": "Network Scope", + "namespace": { + "title": "Namespace", "type": "string" }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" }, - "port": { - "title": "Port", + "subnet_prefix": { + "title": "Subnet Prefix Length", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, "type": { "title": "Type", "type": "string" @@ -4492,17 +4188,6 @@ 2, 3, 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], "title": "Type ID", @@ -4511,39 +4196,17 @@ "uid": { "title": "Unique ID", "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" } }, - "title": "Network Endpoint", + "title": "Network Interface", "type": "object" }, - "network_interface": { + "user": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" + "account" ] }, { @@ -4558,35 +4221,86 @@ } ], "properties": { - "hostname": { - "title": "Hostname", + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "ip": { - "title": "IP Address", + "display_name": { + "title": "Display Name", "type": "string" }, - "mac": { - "title": "MAC Address", + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", "type": "string" }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, "name": { "title": "Name", "type": "string" }, - "namespace": { - "title": "Namespace", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "open_ports": { + "programmatic_credentials": { "items": { - "$ref": "#/$defs/port_info" + "$ref": "#/$defs/programmatic_credential" }, - "title": "Open Ports", + "title": "Programmatic Credentials", "type": "array" }, - "subnet_prefix": { - "title": "Subnet Prefix Length", + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", "type": "integer" }, "type": { @@ -4608,191 +4322,264 @@ "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "title": "Network Interface", + "title": "User", "type": "object" }, - "network_proxy": { + "auth_factor": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - { - "required": [ - "hostname" - ] + "email_addr": { + "title": "Email Address", + "type": "string" }, - { - "required": [ - "instance_uid" - ] + "factor_type": { + "title": "Factor Type", + "type": "string" }, - { - "required": [ - "interface_name" - ] + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" }, - { - "required": [ - "interface_uid" - ] + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" }, - { - "required": [ - "ip" - ] + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" }, - { - "required": [ - "name" - ] + "phone_number": { + "title": "Phone Number", + "type": "string" }, - { - "required": [ - "svc_name" - ] + "provider": { + "title": "Provider", + "type": "string" }, - { - "required": [ - "uid" - ] + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" } + }, + "required": [ + "factor_type_id" ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, "properties": { - "agent_list": { + "references": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "References", "type": "array" }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + "external_uid": { + "title": "External ID", + "type": "string" }, - "domain": { - "title": "Domain", + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", "type": "string" }, - "fingerprints": { + "detection_pattern": { + "title": "Detection Pattern", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "category": { + "title": "Category", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { "items": { - "$ref": "#/$defs/fingerprint" + "type": "string" }, - "title": "Fingerprints", + "title": "Related Subdomains", "type": "array" }, - "hostname": { - "title": "Hostname", + "confidence": { + "title": "Confidence", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "instance_uid": { - "title": "Instance ID", + "type": { + "title": "Type", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", "type": "string" }, - "intermediate_ips": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { "items": { "type": "string" }, - "title": "Intermediate IP Addresses", + "title": "Intrusion Sets", "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" }, - "isp": { - "title": "ISP Name", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "isp_org": { - "title": "ISP Org", - "type": "string" + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" }, - "mac": { - "title": "MAC Address", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "Related File" }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, "name": { "title": "Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" }, - "network_scope": { - "title": "Network Scope", - "type": "string" + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" }, - "network_scope_id": { + "detection_pattern_type_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", + "title": "Detection Pattern Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", + "detection_pattern_type": { + "title": "Detection Pattern", "type": "string" }, - "svc_name": { - "title": "Service Name", - "type": "string" + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" }, "type_id": { "enum": [ @@ -4811,155 +4598,105 @@ 12, 13, 14, - 15, 99 ], - "title": "Type ID", + "title": "Indicator Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" }, - "zone": { - "title": "Network Zone", + "severity": { + "title": "Severity", "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "node": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" }, - "desc": { - "title": "Description", - "type": "string" + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" }, - "name": { - "title": "Name", + "src_url": { + "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "subnet": { + "title": "Related Subnet", "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" } }, "required": [ - "uid" + "type_id", + "value" ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", + "title": "OSINT", "type": "object" }, - "observable": { + "san": { "additionalProperties": false, "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", + "type": { + "title": "Type", "type": "string" } }, "required": [ - "type_id" + "name", + "type" ], - "title": "Observable", + "title": "Subject Alternative Name", "type": "object" }, "occurrence_details": { @@ -5052,7 +4789,7 @@ "title": "Occurrence Details", "type": "object" }, - "organization": { + "firewall_rule": { "additionalProperties": false, "anyOf": [ { @@ -5067,325 +4804,140 @@ } ], "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, "category": { "title": "Category", "type": "string" }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", + "condition": { + "title": "Condition", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, "desc": { "title": "Description", "type": "string" }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { + "match_details": { "items": { "type": "string" }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", + "title": "Match Details", "type": "array" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "match_location": { + "title": "Match Location", + "type": "string" }, "name": { "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "type": "string" }, - "risk_score": { - "title": "Risk Score", + "rate_limit": { + "title": "Rate Limit", "type": "integer" }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" + "sensitivity": { + "title": "Sensitivity", + "type": "string" }, - "severity": { - "title": "Severity", + "type": { + "title": "Type", "type": "string" }, - "severity_id": { + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Severity ID", + "title": "Threat Actor Type ID", "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" }, - "src_url": { - "title": "Source URL", + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" + "license_url": { + "title": "Software License URL", + "type": "string" }, - "subnet": { - "title": "Related Subnet", + "name": { + "title": "Name", "type": "string" }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" + "package_manager": { + "title": "Package Manager", + "type": "string" }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", "type": "string" }, "type": { @@ -5397,144 +4949,328 @@ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, 99 ], - "title": "Indicator Type ID", + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Package", + "type": "object" + }, + "transformation_info": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "time": { + "title": "Event Time", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" }, - "uploaded_time": { - "title": "Uploaded Time", + "url_string": { + "title": "URL String", + "type": "string" + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", "type": "integer" }, - "value": { - "title": "Indicator", + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" + }, + "data": { + "title": "Data" + }, + "error": { + "title": "Error Code", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "error_message": { + "title": "Error Message", "type": "string" }, - "vulnerabilities": { + "flags": { "items": { - "$ref": "#/$defs/vulnerability" + "type": "string" }, - "title": "Related Vulnerabilities", + "title": "Flags", "type": "array" }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] } - }, - "required": [ - "type_id", - "value" ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", + "hostname": { + "title": "Hostname", "type": "string" }, - "cpe_name": { - "title": "The product CPE identifier", + "ip": { + "title": "IP Address", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "license": { - "title": "Software License", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] }, - "license_url": { - "title": "Software License URL", - "type": "string" + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { + "items": { + "type": "string" + }, + "title": "Website Categorization", + "type": "array" }, - "name": { - "title": "Name", - "type": "string" + "category_ids": { + "items": { + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" + }, + "title": "Website Categorization IDs", + "type": "array" }, - "package_manager": { - "title": "Package Manager", + "domain": { + "title": "Domain", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "hostname": { + "title": "Hostname", "type": "string" }, - "purl": { - "title": "Package URL", + "path": { + "title": "Path", "type": "string" }, - "release": { - "title": "Software Release Details", - "type": "string" + "port": { + "title": "Port", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "query_string": { + "title": "HTTP Query String", "type": "string" }, - "type": { - "title": "Type", + "resource_type": { + "title": "Resource Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", + "scheme": { + "title": "Scheme", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "subdomain": { + "title": "Subdomain", "type": "string" }, - "version": { - "title": "Version", + "url_string": { + "title": "URL String", "type": "string" } }, - "required": [ - "name", - "version" - ], - "title": "Software Package", + "title": "Uniform Resource Locator", "type": "object" }, - "policy": { + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { "additionalProperties": false, "anyOf": [ { @@ -5542,11 +5278,6 @@ "name" ] }, - { - "required": [ - "type" - ] - }, { "required": [ "uid" @@ -5554,39 +5285,79 @@ } ], "properties": { - "data": { - "title": "Data" + "name": { + "title": "Name", + "type": "string" }, - "desc": { - "title": "Description", + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" }, - "is_applied": { - "title": "Applied", - "type": "boolean" + "cores": { + "title": "Cores", + "type": "integer" }, - "name": { - "title": "Name", + "model": { + "title": "Model", "type": "string" }, - "type": { - "title": "Type", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "uid": { - "title": "Unique ID", + "vram_mode": { + "title": "VRAM Mode", "type": "string" }, - "version": { - "title": "Version", - "type": "string" + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" } }, - "title": "Policy", + "title": "GPU Information", "type": "object" }, "port_info": { @@ -5611,17 +5382,12 @@ "title": "Port Information", "type": "object" }, - "process": { + "service": { "additionalProperties": false, "anyOf": [ { "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" + "name" ] }, { @@ -5631,152 +5397,89 @@ } ], "properties": { - "ancestry": { + "labels": { "items": { - "$ref": "#/$defs/process_entity" + "type": "string" }, - "title": "Ancestry", + "title": "Labels", "type": "array" }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "cpid": { - "title": "Common Process Identifier", + "name": { + "title": "Name", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { + "tags": { "items": { - "$ref": "#/$defs/win_win_service" + "$ref": "#/$defs/key_value_object" }, - "title": "Hosted Services", + "title": "Tags", "type": "array" }, - "integrity": { - "title": "Integrity", + "uid": { + "title": "Unique ID", "type": "string" }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" }, - "lineage": { + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { "items": { - "type": "string" + "$ref": "#/$defs/container" }, - "title": "Lineage", + "title": "Containers", "type": "array" }, - "loaded_modules": { + "data": { + "title": "Data" + }, + "flags": { "items": { "type": "string" }, - "title": "Loaded Modules", + "title": "Flags", "type": "array" }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, "uid": { "title": "Unique ID", "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, - "title": "Process", + "required": [ + "uid" + ], + "title": "Request Elements", "type": "object" }, - "process_entity": { + "sub_technique": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, { "required": [ "name" @@ -5784,54 +5487,28 @@ }, { "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, + "uid" + ] + } + ], + "properties": { "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "src_url": { + "title": "Source URL", "type": "string" }, - "pid": { - "title": "Process ID", - "type": "integer" - }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "Process Entity", + "title": "MITRE Sub-technique", "type": "object" }, - "product": { + "container": { "additionalProperties": false, "anyOf": [ { @@ -5846,123 +5523,67 @@ } ], "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" + "image": { + "$ref": "#/$defs/image", + "title": "Image" }, - "lang": { - "title": "Language", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "network_driver": { + "title": "Network Driver", "type": "string" }, - "uid": { - "title": "Unique ID", + "orchestrator": { + "title": "Orchestrator", "type": "string" }, - "url_string": { - "title": "URL String", + "pod_uuid": { + "title": "Pod UUID", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "runtime": { + "title": "Runtime", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", + "size": { + "title": "Size", "type": "integer" }, - "type": { - "title": "Type", + "tag": { + "title": "Image Tag", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { + "tags": { "items": { - "$ref": "#/$defs/cis_control" + "$ref": "#/$defs/key_value_object" }, - "title": "CIS Controls", + "title": "Tags", "type": "array" }, - "desc": { - "title": "Description", + "uid": { + "title": "Unique ID", "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" } }, - "required": [ - "desc" - ], - "title": "Remediation", + "title": "Container", "type": "object" }, - "reporter": { + "malware": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, { "required": [ "name" @@ -5975,46 +5596,80 @@ } ], "properties": { - "hostname": { - "title": "Hostname", - "type": "string" + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" + }, + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "path": { + "title": "Path", "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" }, "provider": { "title": "Provider", "type": "string" }, - "score": { - "title": "Reputation Score", + "severity": { + "title": "Severity", "type": "string" }, - "score_id": { + "severity_id": { "enum": [ 0, 1, @@ -6023,42 +5678,10 @@ 4, 5, 6, - 7, - 8, - 9, - 10, 99 ], - "title": "Reputation Score ID", + "title": "Severity ID", "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" }, "uid": { "title": "Unique ID", @@ -6066,92 +5689,145 @@ } }, "required": [ - "uid" + "classification_ids" ], - "title": "Request Elements", + "title": "Malware", "type": "object" }, - "resource_details": { + "win_win_service": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "cmd_line" ] }, { "required": [ - "uid" + "service_category_id" + ] + }, + { + "required": [ + "service_dependencies" + ] + }, + { + "required": [ + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" ] } ], "properties": { - "agent_list": { + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "Labels", "type": "array" }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "criticality": { - "title": "Criticality", + "load_order_group": { + "title": "Load Order Group", "type": "string" }, - "data": { - "title": "Data" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "hostname": { - "title": "Hostname", + "name": { + "title": "Name", "type": "string" }, - "ip": { - "title": "IP Address", + "service_category": { + "title": "Service Category", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" }, - "labels": { + "service_dependencies": { "items": { "type": "string" }, - "title": "Labels", + "title": "Service Dependencies", "type": "array" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" }, - "name": { - "title": "Name", + "service_error_control": { + "title": "Service Error Control", "type": "string" }, - "namespace": { - "title": "Namespace", + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "service_start_type": { + "title": "Service Start Type", + "type": "string" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" }, - "role": { - "title": "Role", + "service_type": { + "title": "Service Type", "type": "string" }, - "role_id": { + "service_type_id": { "enum": [ 0, 1, @@ -6160,7 +5836,7 @@ 4, 99 ], - "title": "Role ID", + "title": "Service Type ID", "type": "integer" }, "tags": { @@ -6170,69 +5846,99 @@ "title": "Tags", "type": "array" }, - "type": { - "title": "Type", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Resource Details", + "required": [ + "name" + ], + "title": "Windows Service", "type": "object" }, - "response": { + "group": { "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" + "anyOf": [ + { + "required": [ + "name" + ] }, - "data": { - "title": "Data" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" }, - "error": { - "title": "Error Code", + "domain": { + "title": "Domain", "type": "string" }, - "error_message": { - "title": "Error Message", + "name": { + "title": "Name", "type": "string" }, - "flags": { + "privileges": { "items": { "type": "string" }, - "title": "Flags", + "title": "Privileges", "type": "array" }, - "message": { - "title": "Message", + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", "type": "string" } }, - "title": "Response Elements", + "title": "Group", "type": "object" }, - "rule": { + "device": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" @@ -6245,114 +5951,157 @@ } ], "properties": { - "category": { - "title": "Category", + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, "desc": { "title": "Description", "type": "string" }, - "name": { - "title": "Name", + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", "type": "string" }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "version": { - "title": "Version", + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", "type": "string" }, - "type": { - "title": "Type", + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "sbom": { - "additionalProperties": false, - "properties": { + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, "created_time": { "title": "Created Time", "type": "integer" }, - "package": { - "$ref": "#/$defs/package", - "title": "Software Package" + "is_shared": { + "title": "Shared Device", + "type": "boolean" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "software_components": { + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { "items": { - "$ref": "#/$defs/software_component" + "$ref": "#/$defs/group" }, - "title": "Software Components", + "title": "Groups", "type": "array" }, - "type": { - "title": "Type", + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, + "name": { + "title": "Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "uid": { - "title": "SBOM ID", + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "version": { - "title": "Version", + "udid": { + "title": "Unique Device Identifier", "type": "string" - } - }, - "required": [ - "package", - "software_components" - ], - "title": "Software Bill of Materials", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", + }, + "model": { + "title": "Model", "type": "string" }, - "auth_protocol_id": { + "type_id": { "enum": [ 0, 1, @@ -6367,58 +6116,39 @@ 10, 11, 12, + 13, + 14, + 15, 99 ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", + "title": "Type ID", "type": "integer" }, - "modified_time": { - "title": "Modified Time", + "last_seen_time": { + "title": "Last Seen", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "rate_limit": { - "title": "Rate Limit", + "boot_time": { + "title": "Boot Time", "type": "integer" }, - "scim_group_schema": { - "title": "SCIM Group Schema" + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" }, - "scim_user_schema": { - "title": "SCIM User Schema" + "is_managed": { + "title": "Managed Device", + "type": "boolean" }, - "state": { - "title": "State", - "type": "string" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "state_id": { + "risk_level_id": { "enum": [ 0, 1, @@ -6427,234 +6157,208 @@ 4, 99 ], - "title": "State ID", + "title": "Risk Level ID", "type": "integer" }, - "uid": { - "title": "Unique ID", + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "uid_alt": { - "title": "External ID", + "subnet": { + "title": "Subnet", "type": "string" }, - "url_string": { - "title": "SCIM Endpoint URL", + "eid": { + "title": "EID", "type": "string" }, - "vendor_name": { - "title": "Service Provider", + "domain": { + "title": "Domain", "type": "string" }, - "version": { - "title": "SCIM Version", + "imei": { + "title": "IMEI", "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" }, - "hashes": { + "agent_list": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/agent" }, - "title": "Hashes", + "title": "Agent List", "type": "array" }, - "name": { - "title": "Name", + "ip": { + "title": "IP Address", "type": "string" }, - "parent_uid": { - "title": "Parent Unique ID", + "hostname": { + "title": "Hostname", "type": "string" }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" }, - "uid": { - "title": "Unique ID", + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, "required": [ - "script_content", "type_id" ], - "title": "Script", + "title": "Device", "type": "object" }, - "service": { + "campaign": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, "name": { "title": "Name", "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, - "title": "Service", + "required": [ + "name" + ], + "title": "Campaign", "type": "object" }, - "session": { + "cwe": { "additionalProperties": false, "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", + "caption": { + "title": "Caption", "type": "string" }, - "terminal": { - "title": "Terminal", + "src_url": { + "title": "Source URL", "type": "string" }, "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", + "title": "CWE ID", "type": "string" } }, - "title": "Session", + "required": [ + "uid" + ], + "title": "CWE", "type": "object" }, - "software_component": { + "digital_signature": { "additionalProperties": false, "properties": { - "author": { - "title": "Author", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" }, - "license": { - "title": "Software License", - "type": "string" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" }, - "name": { - "title": "Name", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "purl": { - "title": "Package URL", + "developer_uid": { + "title": "Developer UID", "type": "string" }, - "related_component": { - "title": "Related Component", - "type": "string" + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" }, - "relationship": { - "title": "Relationship", + "state": { + "title": "State", "type": "string" }, - "relationship_id": { + "state_id": { "enum": [ 0, 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, 99 ], - "title": "Relationship ID", + "title": "State ID", + "type": "integer" + } + }, + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", + "type": "object" + }, + "sbom": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", "type": "integer" }, + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { + "items": { + "$ref": "#/$defs/software_component" + }, + "title": "Software Components", + "type": "array" + }, "type": { "title": "Type", "type": "string" @@ -6670,74 +6374,107 @@ "title": "Type ID", "type": "integer" }, + "uid": { + "title": "SBOM ID", + "type": "string" + }, "version": { "title": "Version", "type": "string" } }, "required": [ - "name", - "version" + "package", + "software_components" ], - "title": "Software Component", + "title": "Software Bill of Materials", "type": "object" }, - "span": { + "malware_scan_info": { "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "end_time": { "title": "End Time", "type": "integer" }, - "message": { - "title": "Message", + "name": { + "title": "Name", "type": "string" }, - "operation": { - "title": "Operation", - "type": "string" + "num_files": { + "title": "Scanned Files", + "type": "integer" }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" }, "start_time": { "title": "Start Time", "type": "integer" }, - "status_code": { - "title": "Status Code", + "type": { + "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, "uid": { - "title": "Unique ID", + "title": "Scan UID", "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" } }, "required": [ - "end_time", - "start_time", - "uid" + "type_id" ], - "title": "Span", + "title": "Malware Scan Info", "type": "object" }, - "sso": { + "kill_chain_phase": { "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "phase": { + "title": "Kill Chain Phase", "type": "string" }, - "auth_protocol_id": { + "phase_id": { "enum": [ 0, 1, @@ -6747,76 +6484,19 @@ 5, 6, 7, - 8, - 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", + "title": "Kill Chain Phase ID", "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" } }, - "title": "SSO", + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", "type": "object" }, - "sub_technique": { + "organization": { "additionalProperties": false, "anyOf": [ { @@ -6835,8 +6515,12 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", "type": "string" }, "uid": { @@ -6844,10 +6528,47 @@ "type": "string" } }, - "title": "MITRE Sub-technique", + "title": "Organization", "type": "object" }, - "tactic": { + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { "additionalProperties": false, "anyOf": [ { @@ -6855,30 +6576,78 @@ "name" ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "MITRE Tactic", + "title": "Logger", "type": "object" }, - "technique": { + "feature": { "additionalProperties": false, "anyOf": [ { @@ -6897,46 +6666,16 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" }, - "type": { - "title": "Threat Actor Type", + "version": { + "title": "Version", "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" } }, - "required": [ - "name" - ], - "title": "Threat Actor", + "title": "Feature", "type": "object" }, "timespan": { @@ -7059,37 +6798,146 @@ "title": "Time Span", "type": "object" }, - "token": { + "rule": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" + "category": { + "title": "Category", + "type": "string" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "desc": { + "title": "Description", + "type": "string" }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" + "name": { + "title": "Name", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "software_component": { + "additionalProperties": false, + "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "tenant_uid": { - "title": "Tenant UID", + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", "type": "string" }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, "type": { "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "name", + "version" + ], + "title": "Software Component", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, "type_id": { "enum": [ 0, @@ -7100,273 +6948,352 @@ 5, 6, 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, 99 ], - "title": "Type ID", + "title": "DNSSEC Status ID", "type": "integer" }, - "uid": { - "title": "Unique ID", + "domain": { + "title": "Domain", "type": "string" }, - "zone": { - "title": "Network Zone", + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" + }, + "email_addr": { + "title": "Registrar Abuse Email Address", "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" }, - "end_time": { - "title": "End Time", + "isp": { + "title": "ISP Name", + "type": "string" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", "type": "integer" }, - "flags": { + "name_servers": { "items": { "type": "string" }, - "title": "Flags", + "title": "Name Servers", "type": "array" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" + "registrar": { + "title": "Domain Registrar", + "type": "string" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "status": { + "title": "Domain Status", + "type": "string" }, - "uid": { - "title": "Unique ID", + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Trace", + "title": "WHOIS", "type": "object" }, - "transformation_info": { + "key_value_object": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "value" ] }, { "required": [ - "uid" + "values" ] } ], "properties": { - "lang": { - "title": "Language", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "value": { + "title": "Value", "type": "string" }, - "url_string": { - "title": "URL String", - "type": "string" + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" } }, - "title": "Transformation Info", + "required": [ + "name" + ], + "title": "Key:Value object", "type": "object" }, - "url": { + "metadata": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], "properties": { - "categories": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { "items": { - "type": "string" + "$ref": "#/$defs/transformation_info" }, - "title": "Website Categorization", + "title": "Transformation Info", "type": "array" }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" }, - "title": "Website Categorization IDs", + "title": "Schema Extensions", "type": "array" }, - "domain": { - "title": "Domain", + "source": { + "title": "Source", "type": "string" }, - "hostname": { - "title": "Hostname", + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" + }, + "log_source": { + "title": "Log Source", "type": "string" }, - "path": { - "title": "Path", + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", "type": "string" }, - "port": { - "title": "Port", + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", + "type": "string" + }, + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "sequence": { + "title": "Sequence Number", "type": "integer" }, - "query_string": { - "title": "HTTP Query String", + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", "type": "string" }, - "resource_type": { - "title": "Resource Type", + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "scheme": { - "title": "Scheme", + "name": { + "title": "Name", "type": "string" }, - "subdomain": { - "title": "Subdomain", + "type": { + "title": "Type", "type": "string" }, - "url_string": { - "title": "URL String", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Uniform Resource Locator", + "required": [ + "uid" + ], + "title": "Node", "type": "object" }, - "user": { + "product": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "account" - ] - }, { "required": [ "name" @@ -7379,549 +7306,622 @@ } ], "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "display_name": { - "title": "Display Name", - "type": "string" + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" }, - "domain": { - "title": "Domain", + "lang": { + "title": "Language", "type": "string" }, - "email_addr": { - "title": "Email Address", + "name": { + "title": "Name", "type": "string" }, - "forward_addr": { - "title": "Forwarding Address", + "path": { + "title": "Path", "type": "string" }, - "full_name": { - "title": "Full Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", + "url_string": { + "title": "URL String", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "vendor_name": { + "title": "Vendor Name", + "type": "string" }, - "phone_number": { - "title": "Telephone Number", + "version": { + "title": "Version", "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" + "bulletin": { + "title": "Patch Bulletin", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "classification": { + "title": "Classification", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", + "created_time": { + "title": "Created Time", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "desc": { + "title": "Description", + "type": "string" }, - "type": { - "title": "Type", + "install_state": { + "title": "Install State", "type": "string" }, - "type_id": { + "install_state_id": { "enum": [ 0, 1, 2, 3, - 4, 99 ], - "title": "Type ID", + "title": "Install State ID", "type": "integer" }, - "uid": { - "title": "Unique ID", + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", "type": "string" } }, - "title": "User", + "required": [ + "uid" + ], + "title": "Advisory", "type": "object" }, - "vulnerability": { + "network_endpoint": { "additionalProperties": false, - "oneOf": [ + "anyOf": [ { - "not": { - "required": [ - "cve", - "cwe" - ] - }, "required": [ - "advisory" + "domain" ] }, { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, "required": [ - "cve" + "hostname" ] }, { - "not": { - "required": [ - "advisory", - "cve" - ] - }, "required": [ - "cwe" + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" ] } ], "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" + "interface_name": { + "title": "Network Interface Name", + "type": "string" }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" + "uid": { + "title": "Unique ID", + "type": "string" }, - "category": { - "title": "Category", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "port": { + "title": "Port", + "type": "integer" }, - "dependency_chain": { - "title": "Dependency Chain", + "type": { + "title": "Type", "type": "string" }, - "desc": { - "title": "Description", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" + "mac": { + "title": "MAC Address", + "type": "string" }, - "exploit_ref_url": { - "title": "Exploit URL", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", "type": "string" }, - "exploit_requirement": { - "title": "Exploit Requirement", + "isp": { + "title": "ISP Name", "type": "string" }, - "exploit_type": { - "title": "Exploit Type", + "zone": { + "title": "Network Zone", "type": "string" }, - "first_seen_time": { - "title": "First Seen", + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - "fix_coverage": { - "title": "Fix Coverage", + "svc_name": { + "title": "Service Name", "type": "string" }, - "fix_coverage_id": { + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Fix Coverage ID", + "title": "Type ID", "type": "integer" }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" + "network_scope": { + "title": "Network Scope", + "type": "string" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "kb_articles": { + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { "items": { "type": "string" }, - "title": "Knowledgebase Articles", + "title": "Intermediate IP Addresses", "type": "array" }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "isp_org": { + "title": "ISP Org", + "type": "string" }, - "packages": { + "fingerprints": { "items": { - "$ref": "#/$defs/package" + "$ref": "#/$defs/fingerprint" }, - "title": "Software Packages", + "title": "Fingerprints", "type": "array" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "vpc_uid": { + "title": "VPC UID", + "type": "string" }, - "related_vulnerabilities": { + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { "items": { - "type": "string" + "$ref": "#/$defs/agent" }, - "title": "Related Vulnerability IDs", + "title": "Agent List", "type": "array" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "ip": { + "title": "IP Address", + "type": "string" }, - "severity": { - "title": "Severity", + "hostname": { + "title": "Hostname", "type": "string" }, - "title": { - "title": "Title", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "title": "Vulnerability Details", + "title": "Network Endpoint", "type": "object" }, - "whois": { + "d3f_tactic": { "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, - "dnssec_status": { - "title": "DNSSEC Status", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "domain": { - "title": "Domain", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" }, - "domain_contacts": { + "cvss": { "items": { - "$ref": "#/$defs/domain_contact" + "$ref": "#/$defs/cvss" }, - "title": "Domain Contacts", + "title": "CVSS Score", "type": "array" }, - "email_addr": { - "title": "Registrar Abuse Email Address", + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", "type": "string" }, - "isp": { - "title": "ISP Name", + "cwe_url": { + "title": "CWE URL", "type": "string" }, - "isp_org": { - "title": "ISP Org", + "desc": { + "title": "Description", "type": "string" }, - "last_seen_time": { - "title": "Last Updated At", + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "name_servers": { + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { "items": { "type": "string" }, - "title": "Name Servers", + "title": "References", "type": "array" }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" }, - "registrar": { - "title": "Domain Registrar", + "title": { + "title": "Title", "type": "string" }, - "status": { - "title": "Domain Status", + "type": { + "title": "Vulnerability Type", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", + "uid": { + "title": "CVE ID", "type": "string" } }, - "title": "WHOIS", + "required": [ + "uid" + ], + "title": "CVE", "type": "object" }, - "win_win_service": { + "domain_contact": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" }, - { - "required": [ - "service_category_id" - ] + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" }, - { - "required": [ - "service_dependencies" - ] + "name": { + "title": "Name", + "type": "string" }, - { - "required": [ - "service_error_control_id" - ] + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "service_start_name" + "name" ] }, { "required": [ - "service_start_type_id" + "type" ] }, { "required": [ - "service_type_id" + "uid" ] } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" + "data": { + "title": "Data" }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" + "desc": { + "title": "Description", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" + "is_applied": { + "title": "Applied", + "type": "boolean" }, "name": { "title": "Name", "type": "string" }, - "service_category": { - "title": "Service Category", + "type": { + "title": "Type", "type": "string" }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", + "uid": { + "title": "Unique ID", "type": "string" }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" + "end_time": { + "title": "End Time", + "type": "integer" }, - "service_start_name": { - "title": "Service Start Name", + "message": { + "title": "Message", "type": "string" }, - "service_start_type": { - "title": "Service Start Type", + "operation": { + "title": "Operation", "type": "string" }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "status_code": { + "title": "Status Code", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "name" + "end_time", + "start_time", + "uid" ], - "title": "Windows Service", + "title": "Span", "type": "object" } }, @@ -7929,62 +7929,20 @@ "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" - }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Activity ID", - "type": "integer" + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" }, - "activity_name": { - "title": "Activity", + "message": { + "title": "Message", "type": "string" }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "api": { - "$ref": "#/$defs/api", - "title": "API Details" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" }, - "category_name": { - "title": "Category", + "disposition": { + "title": "Disposition", "type": "string" }, "category_uid": { @@ -7992,44 +7950,36 @@ "title": "Category ID", "type": "integer" }, - "class_name": { - "title": "Class", + "action": { + "title": "Action", "type": "string" }, - "class_uid": { - "const": 6003, - "title": "Class ID", - "type": "integer" - }, "confidence": { "title": "Confidence", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, "confidence_score": { "title": "Confidence Score", "type": "integer" }, - "count": { - "title": "Count", - "type": "integer" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "disposition": { - "title": "Disposition", + "status_code": { + "title": "Status Code", "type": "string" }, "disposition_id": { @@ -8067,60 +8017,74 @@ "title": "Disposition ID", "type": "integer" }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" + "type_name": { + "title": "Type Name", + "type": "string" }, - "duration": { - "title": "Duration Milliseconds", + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", "type": "integer" }, - "end_time": { - "title": "End Time", + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", "type": "integer" }, - "enrichments": { + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "attacks": { "items": { - "$ref": "#/$defs/enrichment" + "$ref": "#/$defs/attack" }, - "title": "Enrichments", + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", "type": "array" }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "http_request": { - "$ref": "#/$defs/http_request", - "title": "HTTP Request" + "status": { + "title": "Status", + "type": "string" }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" }, - "is_alert": { - "title": "Alert", - "type": "boolean" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "malware": { + "resources": { "items": { - "$ref": "#/$defs/malware" + "$ref": "#/$defs/resource_details" }, - "title": "Malware", + "title": "Resources Array", "type": "array" }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, "observables": { "items": { "$ref": "#/$defs/observable" @@ -8128,38 +8092,29 @@ "title": "Observables", "type": "array" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" }, - "resources": { + "authorizations": { "items": { - "$ref": "#/$defs/resource_details" + "$ref": "#/$defs/authorization" }, - "title": "Resources Array", + "title": "Authorization Information", "type": "array" }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" }, - "risk_level_id": { + "action_id": { "enum": [ 0, 1, @@ -8168,84 +8123,129 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "Action ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", "type": "integer" }, - "severity": { - "title": "Severity", + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", "type": "string" }, - "severity_id": { + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Severity ID", + "title": "Risk Level ID", "type": "integer" }, - "src_endpoint": { + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "dst_endpoint": { "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" + "title": "Destination Endpoint" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "is_alert": { + "title": "Alert", + "type": "boolean" }, - "status": { - "title": "Status", - "type": "string" + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "status_code": { - "title": "Status Code", + "severity": { + "title": "Severity", "type": "string" }, - "status_detail": { - "title": "Status Detail", + "category_name": { + "title": "Category", "type": "string" }, - "status_id": { + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "severity_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Status ID", + "title": "Severity ID", "type": "integer" }, - "time": { - "title": "Event Time", + "count": { + "title": "Count", "type": "integer" }, - "timezone_offset": { - "title": "Timezone Offset", + "end_time": { + "title": "End Time", "type": "integer" }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, "type_uid": { "title": "Type ID", "type": "integer" }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" } }, "required": [ diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json index 0dcdad87a1..7c1523afd3 100644 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@container+host+trace.json @@ -1,11 +1,11 @@ { "$defs": { - "account": { + "kb_article": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "src_url" ] }, { @@ -14,152 +14,6 @@ ] } ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, "properties": { "avg_timespan": { "$ref": "#/$defs/timespan", @@ -177,10 +31,6 @@ "title": "Created Time", "type": "integer" }, - "desc": { - "title": "Description", - "type": "string" - }, "install_state": { "title": "Install State", "type": "string" @@ -200,10 +50,6 @@ "title": "The patch is superseded.", "type": "boolean" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "os": { "$ref": "#/$defs/os", "title": "OS" @@ -212,26 +58,9 @@ "$ref": "#/$defs/product", "title": "Product" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, "size": { "title": "Size", @@ -246,247 +75,238 @@ "type": "string" }, "uid": { - "title": "Advisory ID", + "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Advisory", + "title": "KB Article", "type": "object" }, - "affected_code": { + "long_string": { "additionalProperties": false, "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "start_column": { - "title": "Start Column", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "file" + "value" ], - "title": "Affected Code", + "title": "Long String", "type": "object" }, - "affected_package": { + "enrichment": { "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpe_name": { - "title": "The product CPE identifier", + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "fixed_in_version": { - "title": "Fixed In Version", + "provider": { + "title": "Provider", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "license": { - "title": "Software License", + "short_desc": { + "title": "Short Description", "type": "string" }, - "license_url": { - "title": "Software License URL", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "type": { + "title": "Type", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", "type": "string" }, - "path": { - "title": "Path", + "display_name": { + "title": "Display Name", "type": "string" }, - "purl": { - "title": "Package URL", + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", "type": "string" }, - "release": { - "title": "Software Release Details", + "given_name": { + "title": "Given Name", "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "hire_time": { + "title": "Hire Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "job_title": { + "title": "Job Title", "type": "string" }, - "type": { - "title": "Type", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", "type": "integer" }, - "uid": { - "title": "Package UID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "version": { - "title": "Version", + "surname": { + "title": "Surname", "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" } }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", + "title": "LDAP Person", "type": "object" }, - "agent": { + "email_auth": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Agent Name", + "dkim": { + "title": "DKIM Status", "type": "string" }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", + "dkim_domain": { + "title": "DKIM Domain", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" }, - "uid": { - "title": "Agent ID", + "dmarc": { + "title": "DMARC Status", "type": "string" }, - "uid_alt": { - "title": "Alternate Agent ID", + "dmarc_override": { + "title": "DMARC Override", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "dmarc_policy": { + "title": "DMARC Policy", "type": "string" }, - "version": { - "title": "Agent Version", + "spf": { + "title": "SPF Status", "type": "string" } }, - "title": "Agent", + "title": "Email Authentication", "type": "object" }, - "ai_model": { + "epss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "ai_provider": { - "title": "AI Provider", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "percentile": { + "title": "EPSS Percentile", + "type": "number" }, - "uid": { - "title": "Unique ID", + "score": { + "title": "EPPS Score", "type": "string" }, "version": { @@ -495,54 +315,35 @@ } }, "required": [ - "ai_provider" + "score" ], - "title": "AI Model", + "title": "EPSS", "type": "object" }, - "analytic": { + "device_hw_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", + "bios_manufacturer": { + "title": "BIOS Manufacturer", "type": "string" }, - "desc": { - "title": "Description", + "bios_ver": { + "title": "BIOS Version", "type": "string" }, - "name": { - "title": "Name", + "chassis": { + "title": "Chassis", "type": "string" }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", + "cpu_architecture": { + "title": "CPU Architecture", "type": "string" }, - "state_id": { + "cpu_architecture_id": { "enum": [ 0, 1, @@ -550,93 +351,111 @@ 3, 99 ], - "title": "State ID", + "title": "CPU Architecture ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", + "cpu_cores": { + "title": "CPU Cores", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "cpu_count": { + "title": "CPU Count", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" }, - "operation": { - "title": "Operation", + "cpu_type": { + "title": "Processor Type", "type": "string" }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" + "gpu_count": { + "title": "GPU Count", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" }, - "version": { - "title": "Version", + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "required": [ - "operation" - ], - "title": "API", + "title": "Device Hardware Info", "type": "object" }, - "application": { + "network_proxy": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -644,166 +463,89 @@ } ], "properties": { - "criticality": { - "title": "Business Criticality", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Application Description", + "uid": { + "title": "Unique ID", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "hostname": { - "title": "Hostname", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "name": { - "title": "Application Name", + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Application Relationship" + "instance_uid": { + "title": "Instance ID", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "mac": { + "title": "MAC Address", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "sbom": { - "$ref": "#/$defs/sbom", - "title": "Related SBOM" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Application Type", - "type": "string" - }, - "uid": { - "title": "Application ID", + "isp": { + "title": "ISP Name", "type": "string" }, - "uid_alt": { - "title": "Application Alternative ID", + "zone": { + "title": "Network Zone", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Application Version", + "name": { + "title": "Name", "type": "string" - } - }, - "title": "Application", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" }, - "email_addr": { - "title": "Email Address", - "type": "string" + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - "factor_type": { - "title": "Factor Type", + "svc_name": { + "title": "Service Name", "type": "string" }, - "factor_type_id": { + "type_id": { "enum": [ 0, 1, @@ -817,107 +559,37 @@ 9, 10, 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Factor Type ID", + "title": "Type ID", "type": "integer" }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", + "network_scope": { + "title": "Network Scope", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "security_questions": { + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { "items": { "type": "string" }, - "title": "Security Questions", + "title": "Intermediate IP Addresses", "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + "isp_org": { + "title": "ISP Org", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" }, "fingerprints": { "items": { @@ -926,128 +598,199 @@ "title": "Fingerprints", "type": "array" }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" + "vpc_uid": { + "title": "VPC UID", + "type": "string" }, - "issuer": { - "title": "Issuer Distinguished Name", + "domain": { + "title": "Domain", "type": "string" }, - "sans": { + "agent_list": { "items": { - "$ref": "#/$defs/san" + "$ref": "#/$defs/agent" }, - "title": "Subject Alternative Names", + "title": "Agent List", "type": "array" }, - "serial_number": { - "title": "Certificate Serial Number", + "ip": { + "title": "IP Address", "type": "string" }, - "subject": { - "title": "Subject Distinguished Name", + "hostname": { + "title": "Hostname", "type": "string" }, - "uid": { - "title": "Unique ID", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "version": { - "title": "Version", + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", + "title": "Network Proxy Endpoint", "type": "object" }, - "cis_control": { + "data_classification": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "category_id" + ] + }, + { + "required": [ + "confidentiality_id" + ] + } + ], "properties": { - "desc": { - "title": "Description", + "category": { + "title": "Category", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" }, - "version": { - "title": "Version", + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" + }, + "discovery_details": { + "items": { + "$ref": "#/$defs/discovery_details" + }, + "title": "Discovery Details", + "type": "array" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", + "status": { + "title": "Status", "type": "string" }, + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" + }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "required": [ - "type" - ], - "title": "Classifier Details", + "title": "Data Classification", "type": "object" }, - "cloud": { + "http_response": { "additionalProperties": false, "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" + "body_length": { + "title": "Response Body Length", + "type": "integer" }, - "cloud_partition": { - "title": "Cloud Partition", + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "project_uid": { - "title": "Project ID", - "type": "string" + "latency": { + "title": "Latency", + "type": "integer" }, - "provider": { - "title": "Cloud Provider", - "type": "string" + "length": { + "title": "Response Length", + "type": "integer" }, - "region": { - "title": "Region", + "message": { + "title": "Message", "type": "string" }, - "zone": { - "title": "Cloud Availability Zone", + "status": { + "title": "Status", "type": "string" } }, "required": [ - "provider" + "code" ], - "title": "Cloud", + "title": "HTTP Response", "type": "object" }, - "container": { + "resource_details": { "additionalProperties": false, "anyOf": [ { @@ -1062,13 +805,39 @@ } ], "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" }, "labels": { "items": { @@ -1077,34 +846,42 @@ "title": "Labels", "type": "array" }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "network_driver": { - "title": "Network Driver", + "namespace": { + "title": "Namespace", "type": "string" }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" }, - "runtime": { - "title": "Runtime", + "role": { + "title": "Role", "type": "string" }, - "size": { - "title": "Size", + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", "type": "integer" }, - "tag": { - "title": "Image Tag", - "type": "string" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -1112,279 +889,384 @@ "title": "Tags", "type": "array" }, + "type": { + "title": "Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" - } - }, - "title": "Container", + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Resource Details", "type": "object" }, - "cve": { + "display": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "color_depth": { + "title": "Color Depth", "type": "integer" }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" + "physical_height": { + "title": "Physical Height", + "type": "integer" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" + "physical_width": { + "title": "Physical Width", + "type": "integer" }, - "cwe_url": { - "title": "CWE URL", + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "desc": { - "title": "Description", + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", "type": "string" }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "name": { + "title": "Name", + "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "protocol_name": { + "title": "Supported Protocol", + "type": "string" }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "rate_limit": { + "title": "Rate Limit", + "type": "integer" }, - "title": { - "title": "Title", - "type": "string" + "scim_group_schema": { + "title": "SCIM Group Schema" }, - "type": { - "title": "Vulnerability Type", - "type": "string" + "scim_user_schema": { + "title": "SCIM User Schema" }, - "uid": { - "title": "CVE ID", + "state": { + "title": "State", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" }, - "depth": { + "state_id": { "enum": [ - "Base", - "Environmental", - "Temporal" + 0, + 1, + 2, + 3, + 4, + 99 ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" + "title": "State ID", + "type": "integer" }, - "severity": { - "title": "Severity", + "uid": { + "title": "Unique ID", "type": "string" }, - "src_url": { - "title": "Source URL", + "uid_alt": { + "title": "External ID", "type": "string" }, - "vector_string": { - "title": "Vector String", + "url_string": { + "title": "SCIM Endpoint URL", "type": "string" }, "vendor_name": { - "title": "Vendor Name", + "title": "Service Provider", "type": "string" }, "version": { - "title": "Version", + "title": "SCIM Version", "type": "string" } }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", + "title": "SCIM", "type": "object" }, - "cwe": { + "programmatic_credential": { "additionalProperties": false, "properties": { - "caption": { - "title": "Caption", - "type": "string" + "last_used_time": { + "title": "Last Used Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "type": { + "title": "Type", "type": "string" }, "uid": { - "title": "CWE ID", + "title": "Unique ID", "type": "string" } }, "required": [ "uid" ], - "title": "CWE", + "title": "Programmatic Credential", "type": "object" }, - "d3f_tactic": { + "os": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "build": { + "title": "OS Build", "type": "string" }, - "src_url": { - "title": "Source URL", + "country": { + "title": "Country", "type": "string" }, - "uid": { - "title": "Unique ID", + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "sp_name": { + "title": "OS Service Pack", "type": "string" }, - "uid": { - "title": "Unique ID", + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "MITRE D3FEND\u2122 Technique", + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", "type": "object" }, - "d3fend": { + "tactic": { "additionalProperties": false, "anyOf": [ { "required": [ - "d3f_tactic" + "name" ] }, { "required": [ - "d3f_technique" + "uid" ] } ], "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" + "name": { + "title": "Name", + "type": "string" }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" + "src_url": { + "title": "Source URL", + "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "MITRE D3FEND\u2122", + "title": "MITRE Tactic", "type": "object" }, - "data_classification": { + "dns_answer": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] + "properties": { + "class": { + "title": "Resource Record Class", + "type": "string" }, - { - "required": [ - "confidentiality_id" - ] + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" } + }, + "required": [ + "rdata" ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, "properties": { - "category": { - "title": "Category", + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", "type": "string" }, - "category_id": { + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { "enum": [ 0, 1, @@ -1393,114 +1275,247 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, 99 ], - "title": "Category ID", + "title": "Auth Protocol ID", "type": "integer" }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "duration_mins": { + "title": "SSO Session Duration", "type": "integer" }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" }, - "size": { - "title": "Size", + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "src_url": { - "title": "Source URL", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "status_details": { + "scopes": { "items": { "type": "string" }, - "title": "Status Details", + "title": "Scopes", "type": "array" }, - "status_id": { - "enum": [ - 0, - 1, - 2, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Data Classification", + "title": "Token", "type": "object" }, - "device": { + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "d3f_tactic" ] }, { "required": [ - "instance_uid" + "d3f_technique" ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" }, - { - "required": [ - "interface_name" - ] + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" }, - { - "required": [ - "interface_uid" - ] + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" }, - { - "required": [ - "ip" - ] + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ { "required": [ "name" @@ -1513,207 +1528,192 @@ } ], "properties": { - "agent_list": { + "countermeasures": { "items": { - "$ref": "#/$defs/agent" + "$ref": "#/$defs/d3fend" }, - "title": "Agent List", + "title": "Countermeasures", "type": "array" }, - "autoscale_uid": { - "title": "Autoscale UID", + "name": { + "title": "Name", "type": "string" }, - "boot_time": { - "title": "Boot Time", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "boot_uid": { - "title": "Boot UID", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + { + "required": [ + "country" + ] }, - "created_time": { - "title": "Created Time", - "type": "integer" + { + "required": [ + "postal_code" + ] }, - "desc": { - "title": "Description", + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", "type": "string" }, - "domain": { - "title": "Domain", + "city": { + "title": "City", "type": "string" }, - "eid": { - "title": "EID", + "continent": { + "title": "Continent", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { + "coordinates": { "items": { - "$ref": "#/$defs/group" + "type": "number" }, - "title": "Groups", + "title": "Coordinates", "type": "array" }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", + "country": { + "title": "Country", "type": "string" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", + "desc": { + "title": "Description", "type": "string" }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", + "geodetic_altitude": { + "title": "Geodetic Altitude", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "geohash": { + "title": "Geohash", "type": "string" }, - "ip": { - "title": "IP Address", + "horizontal_accuracy": { + "title": "Horizontal Accuracy", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", + "is_on_premises": { + "title": "On-Premises", "type": "boolean" }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "isp": { + "title": "ISP Name", + "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + "lat": { + "title": "Latitude", + "type": "number" }, - "mac": { - "title": "MAC Address", - "type": "string" + "long": { + "title": "Longitude", + "type": "number" }, - "mac_vendor": { - "title": "MAC Vendor", + "postal_code": { + "title": "Postal Code", "type": "string" }, - "meid": { - "title": "MEID", + "pressure_altitude": { + "title": "Pressure Altitude", "type": "string" }, - "model": { - "title": "Model", + "provider": { + "title": "Provider", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", + "region": { + "title": "Region", "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { "items": { - "$ref": "#/$defs/network_interface" + "$ref": "#/$defs/auth_factor" }, - "title": "Network Interfaces", + "title": "Authentication Factors", "type": "array" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "domain": { + "title": "Domain", + "type": "string" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "issuer": { + "title": "Issuer Details", + "type": "string" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "name": { + "title": "Name", + "type": "string" }, - "region": { - "title": "Region", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "risk_level": { - "title": "Risk Level", + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", "type": "string" }, - "risk_level_id": { + "state_id": { "enum": [ 0, 1, @@ -1722,26 +1722,45 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "subnet": { - "title": "Subnet", + "uid": { + "title": "Unique ID", "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "url_string": { + "title": "Configuration URL", "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] }, - "type": { - "title": "Type", + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", "type": "string" }, - "type_id": { + "ai_role_id": { "enum": [ 0, 1, @@ -1750,636 +1769,550 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "AI Role ID", "type": "integer" }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" + "application": { + "$ref": "#/$defs/application", + "title": "Application" }, - "uid": { - "title": "Unique ID", - "type": "string" + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" }, - "uid_alt": { - "title": "Alternate ID", + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "total_tokens": { + "title": "Total Tokens", + "type": "integer" }, - "zone": { - "title": "Network Zone", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Device", + "title": "Message Context", "type": "object" }, - "device_hw_info": { + "process": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "chassis": { - "title": "Chassis", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "cpu_architecture": { - "title": "CPU Architecture", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", "type": "string" }, - "cpu_architecture_id": { + "integrity_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, 99 ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", + "title": "Integrity Level", "type": "integer" }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" }, - "cpu_type": { - "title": "Processor Type", + "name": { + "title": "Name", "type": "string" }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" + "path": { + "title": "Path", + "type": "string" }, - "ram_size": { - "title": "RAM Size", + "pid": { + "title": "Process ID", "type": "integer" }, - "serial_number": { - "title": "Serial Number", - "type": "string" + "ptid": { + "title": "Process Thread ID", + "type": "integer" }, - "uuid": { - "title": "UUID", + "sandbox": { + "title": "Sandbox", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", + "terminated_time": { + "title": "Terminated Time", "type": "integer" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", + "tid": { + "title": "Thread ID", "type": "integer" }, - "developer_uid": { - "title": "Developer UID", + "uid": { + "title": "Unique ID", "type": "string" }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" + "user": { + "$ref": "#/$defs/user", + "title": "User" }, - "state": { - "title": "State", + "working_directory": { + "title": "Working Directory", "type": "string" }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" } }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", + "title": "Process", "type": "object" }, - "discovery_details": { + "vulnerability": { "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" + "required": [ + "advisory" + ] }, - "physical_width": { - "title": "Physical Width", - "type": "integer" + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, + ], "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" }, - "flag_ids": { + "affected_code": { "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" + "$ref": "#/$defs/affected_code" }, - "title": "DNS Header Flags", + "title": "Affected Code", "type": "array" }, - "flags": { + "affected_packages": { "items": { - "type": "string" + "$ref": "#/$defs/affected_package" }, - "title": "DNS Header Flags", + "title": "Affected Software Packages", "type": "array" }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", + "category": { + "title": "Category", "type": "string" }, - "ttl": { - "title": "TTL", - "type": "integer" + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" }, - "type": { - "title": "Resource Record Type", + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "dependency_chain": { + "title": "Dependency Chain", "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", + }, + "desc": { + "title": "Description", "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", + "type": "integer" }, - "name": { - "title": "Name", + "exploit_ref_url": { + "title": "Exploit URL", "type": "string" }, - "phone_number": { - "title": "Phone Number", + "exploit_requirement": { + "title": "Exploit Requirement", "type": "string" }, - "type": { - "title": "Domain Contact Type", + "exploit_type": { + "title": "Exploit Type", "type": "string" }, - "type_id": { + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, 99 ], - "title": "Domain Contact Type ID", + "title": "Fix Coverage ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "edge": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" }, - "is_directed": { - "title": "Directed", + "is_fix_available": { + "title": "Fix Availability", "type": "boolean" }, - "name": { - "title": "Name", - "type": "string" + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" }, - "relation": { - "title": "Relation", - "type": "string" + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" }, - "source": { - "title": "Source", - "type": "string" + "last_seen_time": { + "title": "Last Seen", + "type": "integer" }, - "target": { - "title": "Target", - "type": "string" + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "source", - "target" - ], - "title": "Edge", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { + "references": { "items": { "type": "string" }, - "title": "Cc", + "title": "References", "type": "array" }, - "cc_mailboxes": { + "related_vulnerabilities": { "items": { "type": "string" }, - "title": "Cc Mailboxes", + "title": "Related Vulnerability IDs", "type": "array" }, - "delivered_to": { - "title": "Delivered To", - "type": "string" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" + "title": { + "title": "Title", + "type": "string" }, - "from": { - "title": "From", + "vendor_name": { + "title": "Vendor Name", "type": "string" + } + }, + "title": "Vulnerability Details", + "type": "object" + }, + "affected_code": { + "additionalProperties": false, + "properties": { + "end_column": { + "title": "End Column", + "type": "integer" }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" + "end_line": { + "title": "End Line", + "type": "integer" }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "is_read": { - "title": "Read", - "type": "boolean" + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" }, - "message_uid": { - "title": "Message UID", + "start_column": { + "title": "Start Column", + "type": "integer" + }, + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "required": [ + "file" + ], + "title": "Affected Code", + "type": "object" + }, + "keyboard_info": { + "additionalProperties": false, + "properties": { + "function_keys": { + "title": "Function Keys", + "type": "integer" + }, + "ime": { + "title": "IME", "type": "string" }, - "raw_header": { - "title": "Raw Header", + "keyboard_layout": { + "title": "Keyboard Layout", "type": "string" }, - "reply_to": { - "title": "Reply To", + "keyboard_subtype": { + "title": "Keyboard Subtype", + "type": "integer" + }, + "keyboard_type": { + "title": "Keyboard Type", "type": "string" + } + }, + "title": "Keyboard Information", + "type": "object" + }, + "certificate": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" }, - "reply_to_list": { + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "fingerprints": { "items": { - "type": "string" + "$ref": "#/$defs/fingerprint" }, - "title": "Reply To List", + "title": "Fingerprints", "type": "array" }, - "reply_to_mailboxes": { + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", + "type": "string" + }, + "sans": { "items": { - "type": "string" + "$ref": "#/$defs/san" }, - "title": "Reply To Mailboxes", + "title": "Subject Alternative Names", "type": "array" }, - "return_path": { - "title": "Return Path", + "serial_number": { + "title": "Certificate Serial Number", "type": "string" }, - "sender": { - "title": "Sender", + "subject": { + "title": "Subject Distinguished Name", "type": "string" }, - "sender_mailbox": { - "title": "Sender Mailbox", + "uid": { + "title": "Unique ID", "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "issuer", + "serial_number" + ], + "title": "Digital Certificate", + "type": "object" + }, + "graph": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "smtp_from": { - "title": "SMTP From", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", "type": "string" }, - "smtp_to": { + "edges": { "items": { - "type": "string" + "$ref": "#/$defs/edge" }, - "title": "SMTP To", + "title": "Edges", "type": "array" }, - "subject": { - "title": "Subject", - "type": "string" + "is_directed": { + "title": "Directed", + "type": "boolean" }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "to_mailboxes": { + "nodes": { "items": { - "type": "string" + "$ref": "#/$defs/node" }, - "title": "To Mailboxes", + "title": "Nodes", "type": "array" }, - "uid": { - "title": "Email Thread UID", + "query_language": { + "title": "Query Language", "type": "string" }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { + "query_language_id": { "enum": [ 0, 1, @@ -2388,124 +2321,127 @@ 4, 5, 6, + 7, 99 ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", + "title": "Query Language ID", "type": "integer" }, - "key_uid": { - "title": "Key UID", + "type": { + "title": "Type", "type": "string" }, - "type": { - "title": "Encryption Type", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Encryption Details", + "required": [ + "nodes" + ], + "title": "Graph", "type": "object" }, - "enrichment": { + "account": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" + "is_disabled": { + "title": "Disabled", + "type": "boolean" }, - "data": { - "title": "Data" + "is_locked": { + "title": "Locked", + "type": "boolean" }, - "desc": { - "title": "Description", - "type": "string" + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "type": { "title": "Type", "type": "string" }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", + "title": "Account", "type": "object" }, - "epss": { + "authorization": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", + "decision": { + "title": "Authorization Decision/Outcome", "type": "string" }, - "version": { - "title": "Version", - "type": "string" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" } }, - "required": [ - "score" - ], - "title": "EPSS", + "title": "Authorization Result", "type": "object" }, - "extension": { + "autonomous_system": { "additionalProperties": false, "anyOf": [ { @@ -2515,7 +2451,7 @@ }, { "required": [ - "uid" + "number" ] } ], @@ -2524,211 +2460,148 @@ "title": "Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" + "number": { + "title": "Number", + "type": "integer" } }, - "required": [ - "version" - ], - "title": "Schema Extension", + "title": "Autonomous System", "type": "object" }, - "feature": { + "classifier_details": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { "name": { "title": "Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "type": { + "title": "Type", + "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Feature", + "required": [ + "type" + ], + "title": "Classifier Details", "type": "object" }, - "file": { + "session": { "additionalProperties": false, "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "count": { + "title": "Count", "type": "integer" }, "created_time": { "title": "Created Time", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "drive_type": { - "title": "Drive Type", + "expiration_reason": { + "title": "Expiration Reason", "type": "string" }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", + "is_mfa": { + "title": "Multi Factor Authentication", "type": "boolean" }, - "is_encrypted": { - "title": "Encrypted", + "is_remote": { + "title": "Remote", "type": "boolean" }, - "is_readonly": { - "title": "Read-Only", + "is_vpn": { + "title": "VPN Session", "type": "boolean" }, - "is_system": { - "title": "System", - "type": "boolean" + "issuer": { + "title": "Issuer Details", + "type": "string" }, - "mime_type": { - "title": "MIME type", + "terminal": { + "title": "Terminal", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "uid": { + "title": "Unique ID", + "type": "string" }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + } + }, + "title": "Session", + "type": "object" + }, + "d3f_technique": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "name": { "title": "Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "src_url": { + "title": "Source URL", + "type": "string" }, - "parent_folder": { - "title": "Parent Folder", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Technique", + "type": "object" + }, + "image": { + "additionalProperties": false, + "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "name": { + "title": "Name", "type": "string" }, "path": { "title": "Path", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", + "tag": { + "title": "Image Tag", "type": "string" }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -2736,106 +2609,18 @@ "title": "Tags", "type": "array" }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, "uid": { "title": "Unique ID", "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, "required": [ - "name", - "type_id" + "uid" ], - "title": "File", + "title": "Image", "type": "object" }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { + "application": { "additionalProperties": false, "anyOf": [ { @@ -2850,163 +2635,130 @@ } ], "properties": { - "category": { - "title": "Category", + "criticality": { + "title": "Business Criticality", "type": "string" }, - "condition": { - "title": "Condition", - "type": "string" + "data": { + "title": "Data" }, "desc": { - "title": "Description", + "title": "Application Description", "type": "string" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "match_details": { + "hostname": { + "title": "Hostname", + "type": "string" + }, + "labels": { "items": { "type": "string" }, - "title": "Match Details", + "title": "Labels", "type": "array" }, - "match_location": { - "title": "Match Location", - "type": "string" - }, "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", + "title": "Application Name", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "uid": { - "title": "Unique ID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "bus_type_id": { + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, - 7, 99 ], - "title": "Bus Type ID", + "title": "Risk Level ID", "type": "integer" }, - "cores": { - "title": "Cores", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "model": { - "title": "Model", + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "uid": { + "title": "Application ID", "type": "string" }, - "vram_mode": { - "title": "VRAM Mode", + "uid_alt": { + "title": "Application Alternative ID", "type": "string" }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" + "version": { + "title": "Application Version", + "type": "string" } }, - "title": "GPU Information", + "title": "Application", "type": "object" }, - "graph": { + "script": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "desc": { - "title": "Description", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "edges": { + "hashes": { "items": { - "$ref": "#/$defs/edge" + "$ref": "#/$defs/fingerprint" }, - "title": "Edges", + "title": "Hashes", "type": "array" }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, "name": { "title": "Name", "type": "string" }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" + "parent_uid": { + "title": "Parent Unique ID", + "type": "string" }, - "query_language": { - "title": "Query Language", + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", "type": "string" }, - "query_language_id": { + "type_id": { "enum": [ 0, 1, @@ -3018,207 +2770,141 @@ 7, 99 ], - "title": "Query Language ID", + "title": "Type ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" } }, "required": [ - "nodes" + "script_content", + "type_id" ], - "title": "Graph", + "title": "Script", "type": "object" }, - "group": { + "affected_package": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "desc": { - "title": "Description", + "architecture": { + "title": "Architecture", "type": "string" }, - "domain": { - "title": "Domain", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "name": { - "title": "Name", + "epoch": { + "title": "Epoch", + "type": "integer" + }, + "fixed_in_version": { + "title": "Fixed In Version", "type": "string" }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "type": { - "title": "Group Type", + "license": { + "title": "Software License", "type": "string" }, - "uid": { - "title": "Unique ID", + "license_url": { + "title": "Software License URL", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "package_manager": { + "title": "Package Manager", "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "http_request": { - "additionalProperties": false, - "properties": { - "args": { - "title": "HTTP Arguments", + }, + "package_manager_url": { + "title": "Package Manager URL", "type": "string" }, - "body_length": { - "title": "Request Body Length", - "type": "integer" + "path": { + "title": "Path", + "type": "string" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "purl": { + "title": "Package URL", + "type": "string" }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", + "release": { + "title": "Software Release Details", "type": "string" }, - "length": { - "title": "Request Length", - "type": "integer" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "referrer": { - "title": "HTTP Referrer", + "src_url": { + "title": "Source URL", "type": "string" }, - "uid": { - "title": "Unique ID", + "type": { + "title": "Type", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "user_agent": { - "title": "HTTP User-Agent", + "uid": { + "title": "Package UID", "type": "string" }, - "version": { - "title": "HTTP Version", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" + "version": { + "title": "Version", + "type": "string" } }, - "title": "HTTP Request", + "required": [ + "name", + "version" + ], + "title": "Affected Software Package", "type": "object" }, - "http_response": { + "cis_control": { "additionalProperties": false, "properties": { - "body_length": { - "title": "Response Body Length", - "type": "integer" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "content_type": { - "title": "HTTP Content Type", + "desc": { + "title": "Description", "type": "string" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" - }, - "length": { - "title": "Response Length", - "type": "integer" - }, - "message": { - "title": "Message", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "version": { + "title": "Version", "type": "string" } }, "required": [ - "code" + "name" ], - "title": "HTTP Response", + "title": "CIS Control", "type": "object" }, - "idp": { + "analytic": { "additionalProperties": false, "anyOf": [ { @@ -3233,44 +2919,28 @@ } ], "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" + "category": { + "title": "Category", + "type": "string" }, - "issuer": { - "title": "Issuer Details", + "desc": { + "title": "Description", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" }, "state": { "title": "State", @@ -3282,56 +2952,86 @@ 1, 2, 3, - 4, 99 ], "title": "State ID", "type": "integer" }, - "tenant_uid": { - "title": "Tenant UID", + "type": { + "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Type ID", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" }, - "url_string": { - "title": "Configuration URL", + "version": { + "title": "Version", "type": "string" } }, - "title": "Identity Provider", + "required": [ + "type_id" + ], + "title": "Analytic", "type": "object" }, - "image": { + "edge": { "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "data": { + "title": "Data" + }, + "is_directed": { + "title": "Directed", + "type": "boolean" + }, + "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "relation": { + "title": "Relation", "type": "string" }, - "tag": { - "title": "Image Tag", + "source": { + "title": "Source", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "target": { + "title": "Target", + "type": "string" }, "uid": { "title": "Unique ID", @@ -3339,165 +3039,219 @@ } }, "required": [ - "uid" + "source", + "target" ], - "title": "Image", + "title": "Edge", "type": "object" }, - "kb_article": { + "actor": { "additionalProperties": false, "anyOf": [ { "required": [ - "src_url" + "app_name" ] }, { "required": [ - "uid" + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" ] } ], "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", + "app_name": { + "title": "Application Name", "type": "string" }, - "classification": { - "title": "Classification", + "app_uid": { + "title": "Application ID", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "authorizations": { + "items": { + "$ref": "#/$defs/authorization" + }, + "title": "Authorization Information", + "type": "array" }, - "install_state": { - "title": "Install State", + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" + }, + "invoked_by": { + "title": "Invoked by", "type": "string" }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" + "process": { + "$ref": "#/$defs/process", + "title": "Process" }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "user": { + "$ref": "#/$defs/user", + "title": "User" + } + }, + "title": "Actor", + "type": "object" + }, + "cloud": { + "additionalProperties": false, + "properties": { + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" }, - "severity": { - "title": "Severity", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "project_uid": { + "title": "Project ID", "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "provider": { + "title": "Cloud Provider", + "type": "string" }, - "src_url": { - "title": "Source URL", + "region": { + "title": "Region", "type": "string" }, - "title": { - "title": "Title", + "zone": { + "title": "Cloud Availability Zone", "type": "string" + } + }, + "required": [ + "provider" + ], + "title": "Cloud", + "type": "object" + }, + "trace": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "KB Article", + "required": [ + "uid" + ], + "title": "Trace", "type": "object" }, - "key_value_object": { + "ai_model": { "additionalProperties": false, "anyOf": [ { "required": [ - "value" + "name" ] }, { "required": [ - "values" + "uid" ] } ], "properties": { + "ai_provider": { + "title": "AI Provider", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "name" + "ai_provider" ], - "title": "Key:Value object", + "title": "AI Model", "type": "object" }, - "keyboard_info": { + "file": { "additionalProperties": false, "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", + "parent_folder": { + "title": "Parent Folder", "type": "string" }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" + "is_system": { + "title": "System", + "type": "boolean" }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { + "confidentiality_id": { "enum": [ 0, 1, @@ -3506,111 +3260,97 @@ 4, 5, 6, - 7, 99 ], - "title": "Kill Chain Phase ID", + "title": "Confidentiality ID", "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", + }, + "uid": { + "title": "Unique ID", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" }, - "deleted_time": { - "title": "Deleted Time", + "is_readonly": { + "title": "Read-Only", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "department": { - "title": "Department", + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", "type": "string" }, - "display_name": { - "title": "Display Name", + "company_name": { + "title": "Company Name", "type": "string" }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" + "attributes": { + "title": "Attributes", + "type": "integer" }, - "employee_uid": { - "title": "Employee ID", + "desc": { + "title": "Description", "type": "string" }, - "given_name": { - "title": "Given Name", + "type": { + "title": "Type", "type": "string" }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", + "path": { + "title": "Path", "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "uri": { + "title": "File URI", + "type": "string" }, - "last_login_time": { - "title": "Last Login", - "type": "integer" + "is_deleted": { + "title": "Deleted", + "type": "boolean" }, - "ldap_cn": { - "title": "LDAP Common Name", + "confidentiality": { + "title": "Confidentiality", "type": "string" }, - "ldap_dn": { - "title": "LDAP Distinguished Name", + "drive_type": { + "title": "Drive Type", "type": "string" }, - "leave_time": { - "title": "Leave Time", + "created_time": { + "title": "Created Time", "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" }, - "office_location": { - "title": "Office Location", - "type": "string" + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" }, - "phone_number": { - "title": "Telephone Number", + "name": { + "title": "Name", "type": "string" }, - "surname": { - "title": "Surname", - "type": "string" + "accessed_time": { + "title": "Accessed Time", + "type": "integer" }, "tags": { "items": { @@ -3618,275 +3358,182 @@ }, "title": "Tags", "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] }, - { - "required": [ - "country" - ] + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 99 + ], + "title": "Type ID", + "type": "integer" }, - { - "required": [ - "postal_code" - ] + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" + "size": { + "title": "Size", + "type": "integer" }, - "city": { - "title": "City", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "continent": { - "title": "Continent", + "internal_name": { + "title": "Internal Name", "type": "string" }, - "coordinates": { + "hashes": { "items": { - "type": "number" + "$ref": "#/$defs/fingerprint" }, - "title": "Coordinates", + "title": "Hashes", "type": "array" }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" }, - "geodetic_altitude": { - "title": "Geodetic Altitude", + "security_descriptor": { + "title": "Security Descriptor", "type": "string" }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", + "volume": { + "title": "Volume", "type": "string" }, - "geohash": { - "title": "Geohash", - "type": "string" + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", + "mime_type": { + "title": "MIME type", "type": "string" }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" }, "product": { "$ref": "#/$defs/product", "title": "Product" }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Logger", + "required": [ + "name", + "type_id" + ], + "title": "File", "type": "object" }, - "long_string": { + "remediation": { "additionalProperties": false, "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" }, - "value": { - "title": "Value", + "desc": { + "title": "Description", "type": "string" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" } }, "required": [ - "value" + "desc" ], - "title": "Long String", + "title": "Remediation", "type": "object" }, - "malware": { + "email": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "from" ] }, { "required": [ - "uid" + "to" ] } ], "properties": { - "classification_ids": { + "cc": { "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" + "type": "string" }, - "title": "Classification IDs", + "title": "Cc", "type": "array" }, - "classifications": { + "cc_mailboxes": { "items": { "type": "string" }, - "title": "Classifications", + "title": "Cc Mailboxes", "type": "array" }, - "cves": { + "delivered_to": { + "title": "Delivered To", + "type": "string" + }, + "delivered_to_list": { "items": { - "$ref": "#/$defs/cve" + "type": "string" }, - "title": "CVE List", + "title": "Delivered To List", "type": "array" }, "files": { @@ -3896,384 +3543,380 @@ "title": "Files", "type": "array" }, - "name": { - "title": "Name", + "from": { + "title": "From", "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" }, - "path": { - "title": "Path", + "from_mailbox": { + "title": "From Mailbox", "type": "string" }, - "provider": { - "title": "Provider", + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" + }, + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", "type": "string" }, - "severity": { - "title": "Severity", + "raw_header": { + "title": "Raw Header", "type": "string" }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "reply_to": { + "title": "Reply To", "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" }, - "name": { - "title": "Name", - "type": "string" + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" }, - "num_files": { - "title": "Scanned Files", - "type": "integer" + "return_path": { + "title": "Return Path", + "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" + "sender": { + "title": "Sender", + "type": "string" }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" }, "size": { "title": "Size", "type": "integer" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "smtp_from": { + "title": "SMTP From", + "type": "string" }, - "type": { - "title": "Type", + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" }, "uid": { - "title": "Scan UID", + "title": "Email Thread UID", "type": "string" }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" + } + }, + "title": "Email", + "type": "object" + }, + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "type_id" + "name", + "value" ], - "title": "Malware Scan Info", + "title": "Environment Variable", "type": "object" }, - "message_context": { + "technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "application" + "name" ] }, { "required": [ - "service" + "uid" ] } ], "properties": { - "ai_role": { - "title": "AI Role", - "type": "string" - }, - "ai_role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "AI Role ID", - "type": "integer" - }, - "application": { - "$ref": "#/$defs/application", - "title": "Application" - }, - "completion_tokens": { - "title": "Completion Tokens", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "prompt_tokens": { - "title": "Prompt Tokens", - "type": "integer" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "total_tokens": { - "title": "Total Tokens", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "Message Context", + "title": "MITRE Technique", "type": "object" }, - "metadata": { + "http_request": { "additionalProperties": false, "properties": { - "correlation_uid": { - "title": "Correlation UID", + "args": { + "title": "HTTP Arguments", "type": "string" }, - "debug": { + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { "items": { - "type": "string" + "$ref": "#/$defs/http_header" }, - "title": "Debug Information", + "title": "HTTP Headers", "type": "array" }, - "event_code": { - "title": "Event Code", + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", "type": "string" }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" + "length": { + "title": "Request Length", + "type": "integer" }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" + "referrer": { + "title": "HTTP Referrer", + "type": "string" }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "uid": { + "title": "Unique ID", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "log_source": { - "title": "Log Source", + "user_agent": { + "title": "HTTP User-Agent", "type": "string" }, - "log_version": { - "title": "Log Version", + "version": { + "title": "HTTP Version", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { + "x_forwarded_for": { "items": { - "$ref": "#/$defs/logger" + "type": "string" }, - "title": "Loggers", + "title": "X-Forwarded-For", "type": "array" + } + }, + "title": "HTTP Request", + "type": "object" + }, + "cvss": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Base Score", + "type": "number" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", "type": "string" }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { + "metrics": { "items": { - "type": "string" + "$ref": "#/$defs/metric" }, - "title": "Profiles", + "title": "Metrics", "type": "array" }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" + "overall_score": { + "title": "Overall Score", + "type": "number" }, - "source": { - "title": "Source", + "severity": { + "title": "Severity", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", + "src_url": { + "title": "Source URL", "type": "string" }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", + "vector_string": { + "title": "Vector String", "type": "string" }, - "uid": { - "title": "Event UID", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, "required": [ - "product", + "base_score", "version" ], - "title": "Metadata", + "title": "CVSS Score", "type": "object" }, - "metric": { + "fingerprint": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", + "algorithm": { + "title": "Algorithm", "type": "string" }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, "value": { "title": "Value", "type": "string" } }, "required": [ - "name", + "algorithm_id", "value" ], - "title": "Metric", + "title": "Fingerprint", "type": "object" }, - "mitigation": { + "process_entity": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, { "required": [ "uid" @@ -4281,270 +3924,290 @@ } ], "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "path": { + "title": "Path", "type": "string" }, + "pid": { + "title": "Process ID", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "MITRE Mitigation", + "title": "Process Entity", "type": "object" }, - "network_endpoint": { + "observable": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] + "properties": { + "event_uid": { + "title": "Event UID", + "type": "string" }, - { - "required": [ - "hostname" - ] + "name": { + "title": "Name", + "type": "string" }, - { - "required": [ - "instance_uid" - ] + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - { - "required": [ - "interface_name" - ] + "type": { + "title": "Type", + "type": "string" }, - { - "required": [ - "interface_uid" - ] + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", + "type": "integer" }, - { - "required": [ - "ip" - ] + "type_uid": { + "title": "Type ID", + "type": "integer" }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "name" + "sub_technique" ] }, { "required": [ - "svc_name" + "tactic" ] }, { "required": [ - "uid" + "technique" ] } ], "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" }, - "domain": { - "title": "Domain", - "type": "string" + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" }, - "fingerprints": { + "tactics": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/tactic" }, - "title": "Fingerprints", + "title": "Tactics", "type": "array" }, - "hostname": { - "title": "Hostname", + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" + }, + "version": { + "title": "Version", "type": "string" + } + }, + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", + "type": "object" + }, + "network_interface": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + { + "required": [ + "ip" + ] }, - "instance_uid": { - "title": "Instance ID", - "type": "string" + { + "required": [ + "mac" + ] }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" + { + "required": [ + "name" + ] }, - "interface_uid": { - "title": "Network Interface ID", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", "type": "string" }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, "ip": { "title": "IP Address", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, "mac": { "title": "MAC Address", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", + "namespace": { + "title": "Namespace", + "type": "string" + }, + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" + }, + "subnet_prefix": { + "title": "Subnet Prefix Length", "type": "integer" }, - "network_scope": { - "title": "Network Scope", + "type": { + "title": "Type", "type": "string" }, - "network_scope_id": { + "type_id": { "enum": [ 0, 1, 2, + 3, + 4, 99 ], - "title": "Network Scope ID", + "title": "Type ID", "type": "integer" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Network Interface", + "type": "object" + }, + "user": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "account" + ] }, { "required": [ @@ -4558,35 +4221,86 @@ } ], "properties": { - "hostname": { - "title": "Hostname", + "account": { + "$ref": "#/$defs/account", + "title": "Account" + }, + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "ip": { - "title": "IP Address", + "display_name": { + "title": "Display Name", "type": "string" }, - "mac": { - "title": "MAC Address", + "domain": { + "title": "Domain", + "type": "string" + }, + "email_addr": { + "title": "Email Address", + "type": "string" + }, + "forward_addr": { + "title": "Forwarding Address", + "type": "string" + }, + "full_name": { + "title": "Full Name", "type": "string" }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" + }, + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" + }, "name": { "title": "Name", "type": "string" }, - "namespace": { - "title": "Namespace", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "open_ports": { + "programmatic_credentials": { "items": { - "$ref": "#/$defs/port_info" + "$ref": "#/$defs/programmatic_credential" }, - "title": "Open Ports", + "title": "Programmatic Credentials", "type": "array" }, - "subnet_prefix": { - "title": "Subnet Prefix Length", + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", + "type": "integer" + }, + "risk_score": { + "title": "Risk Score", "type": "integer" }, "type": { @@ -4608,191 +4322,264 @@ "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "title": "Network Interface", + "title": "User", "type": "object" }, - "network_proxy": { + "auth_factor": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - { - "required": [ - "hostname" - ] + "email_addr": { + "title": "Email Address", + "type": "string" }, - { - "required": [ - "instance_uid" - ] + "factor_type": { + "title": "Factor Type", + "type": "string" }, - { - "required": [ - "interface_name" - ] + "factor_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 99 + ], + "title": "Factor Type ID", + "type": "integer" }, - { - "required": [ - "interface_uid" - ] + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" }, - { - "required": [ - "ip" - ] + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" }, - { - "required": [ - "name" - ] + "phone_number": { + "title": "Phone Number", + "type": "string" }, - { - "required": [ - "svc_name" - ] + "provider": { + "title": "Provider", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { + "security_questions": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "Security Questions", "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { + } + }, + "required": [ + "factor_type_id" + ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, + "properties": { + "references": { "items": { - "$ref": "#/$defs/fingerprint" + "type": "string" }, - "title": "Fingerprints", + "title": "References", "type": "array" }, - "hostname": { - "title": "Hostname", + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" }, - "instance_uid": { - "title": "Instance ID", + "detection_pattern": { + "title": "Detection Pattern", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "category": { + "title": "Category", "type": "string" }, - "intermediate_ips": { + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { "items": { "type": "string" }, - "title": "Intermediate IP Addresses", + "title": "Related Subdomains", "type": "array" }, - "ip": { - "title": "IP Address", + "confidence": { + "title": "Confidence", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "isp_org": { - "title": "ISP Org", + "type": { + "title": "Type", "type": "string" }, + "uploaded_time": { + "title": "Uploaded Time", + "type": "integer" + }, "location": { "$ref": "#/$defs/location", "title": "Geo Location" }, - "mac": { - "title": "MAC Address", + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "comment": { + "title": "Analyst Comments", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", "type": "string" }, - "name": { - "title": "Name", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "intrusion_sets": { + "items": { + "type": "string" + }, + "title": "Intrusion Sets", + "type": "array" + }, + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", + "attacks": { + "items": { + "$ref": "#/$defs/attack" + }, + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", + "type": "array" + }, + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "Related File" + }, + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "network_scope": { - "title": "Network Scope", + "name": { + "title": "Name", "type": "string" }, - "network_scope_id": { + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" + }, + "kill_chain": { + "items": { + "$ref": "#/$defs/kill_chain_phase" + }, + "title": "Kill Chain", + "type": "array" + }, + "detection_pattern_type_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", + "title": "Detection Pattern Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", + "detection_pattern_type": { + "title": "Detection Pattern", "type": "string" }, - "svc_name": { - "title": "Service Name", - "type": "string" + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" }, "type_id": { "enum": [ @@ -4811,155 +4598,105 @@ 12, 13, 14, - 15, 99 ], - "title": "Type ID", + "title": "Indicator Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" }, - "zone": { - "title": "Network Zone", + "severity": { + "title": "Severity", "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "node": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" }, - "desc": { - "title": "Description", - "type": "string" + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" }, - "name": { - "title": "Name", + "src_url": { + "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "subnet": { + "title": "Related Subnet", "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" } }, "required": [ - "uid" + "type_id", + "value" ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", + "title": "OSINT", "type": "object" }, - "observable": { + "san": { "additionalProperties": false, "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, "type": { "title": "Type", "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" } }, "required": [ - "type_id" + "name", + "type" ], - "title": "Observable", + "title": "Subject Alternative Name", "type": "object" }, "occurrence_details": { @@ -5052,7 +4789,7 @@ "title": "Occurrence Details", "type": "object" }, - "organization": { + "firewall_rule": { "additionalProperties": false, "anyOf": [ { @@ -5067,69 +4804,142 @@ } ], "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "ou_name": { - "title": "Org Unit Name", + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", "type": "string" }, - "ou_uid": { - "title": "Org Unit ID", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Organization", + "title": "Firewall Rule", "type": "object" }, - "os": { + "threat_actor": { "additionalProperties": false, "properties": { - "build": { - "title": "OS Build", + "name": { + "title": "Name", "type": "string" }, - "country": { - "title": "Country", + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", "type": "string" }, "cpe_name": { "title": "The product CPE identifier", "type": "string" }, - "cpu_bits": { - "title": "CPU Bits", + "epoch": { + "title": "Epoch", "type": "integer" }, - "edition": { - "title": "OS Edition", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "kernel_release": { - "title": "Kernel Release", + "license": { + "title": "Software License", "type": "string" }, - "lang": { - "title": "Language", + "license_url": { + "title": "Software License URL", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "sp_name": { - "title": "OS Service Pack", + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, "type": { "title": "Type", "type": "string" @@ -5137,21 +4947,21 @@ "type_id": { "enum": [ 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 + 1, + 2, + 99 ], "title": "Type ID", "type": "integer" }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, "version": { "title": "Version", "type": "string" @@ -5159,382 +4969,420 @@ }, "required": [ "name", - "type_id" + "version" ], - "title": "Operating System (OS)", + "title": "Software Package", "type": "object" }, - "osint": { + "transformation_info": { "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "comment": { - "title": "Analyst Comments", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", "type": "string" }, - "confidence": { - "title": "Confidence", + "name": { + "title": "Name", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "created_time": { - "title": "Created Time", + "time": { + "title": "Event Time", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", + "uid": { + "title": "Unique ID", "type": "string" }, - "detection_pattern_type": { - "title": "Detection Pattern", + "url_string": { + "title": "URL String", "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", "type": "integer" }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "data": { + "title": "Data" }, - "external_uid": { - "title": "External ID", + "error": { + "title": "Error Code", "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" + "error_message": { + "title": "Error Message", + "type": "string" }, - "intrusion_sets": { + "flags": { "items": { "type": "string" }, - "title": "Intrusion Sets", + "title": "Flags", "type": "array" }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + { + "required": [ + "ip" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "name" + ] }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "ip": { + "title": "IP Address", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { "items": { - "$ref": "#/$defs/digital_signature" + "type": "string" }, - "title": "Related Digital Signatures", + "title": "Website Categorization", "type": "array" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { + "category_ids": { "items": { - "type": "string" + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" }, - "title": "Related Subdomains", + "title": "Website Categorization IDs", "type": "array" }, - "subnet": { - "title": "Related Subnet", + "domain": { + "title": "Domain", "type": "string" }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", + "hostname": { + "title": "Hostname", "type": "string" }, - "type": { - "title": "Type", + "path": { + "title": "Path", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", + "port": { + "title": "Port", "type": "integer" }, - "uid": { - "title": "Unique ID", + "query_string": { + "title": "HTTP Query String", "type": "string" }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", + "resource_type": { + "title": "Resource Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "scheme": { + "title": "Scheme", "type": "string" }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" + "subdomain": { + "title": "Subdomain", + "type": "string" }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" + "url_string": { + "title": "URL String", + "type": "string" } }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", + "title": "Uniform Resource Locator", "type": "object" }, - "package": { + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "name": { "title": "Name", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "uid": { + "title": "Unique ID", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "version": { + "title": "Version", "type": "string" - }, - "purl": { - "title": "Package URL", + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", "type": "string" }, - "release": { - "title": "Software Release Details", + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", "type": "string" }, - "src_url": { - "title": "Source URL", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "type": { - "title": "Type", + "vram_mode": { + "title": "VRAM Mode", "type": "string" }, - "type_id": { + "vram_mode_id": { "enum": [ 0, 1, 2, 99 ], - "title": "Type ID", + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", "type": "integer" }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", + "protocol_name": { + "title": "Protocol Name", "type": "string" }, - "version": { - "title": "Version", - "type": "string" + "protocol_num": { + "title": "Protocol Number", + "type": "integer" } }, "required": [ - "name", - "version" + "port" ], - "title": "Software Package", + "title": "Port Information", "type": "object" }, - "policy": { + "service": { "additionalProperties": false, "anyOf": [ { @@ -5542,11 +5390,6 @@ "name" ] }, - { - "required": [ - "type" - ] - }, { "required": [ "uid" @@ -5554,28 +5397,23 @@ } ], "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "uid": { "title": "Unique ID", @@ -5586,42 +5424,96 @@ "type": "string" } }, - "title": "Policy", + "title": "Service", "type": "object" }, - "port_info": { + "metric": { "additionalProperties": false, "properties": { - "port": { - "title": "Port", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "protocol_name": { - "title": "Protocol Name", + "value": { + "title": "Value", "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" } }, "required": [ - "port" + "uid" ], - "title": "Port Information", + "title": "Request Elements", "type": "object" }, - "process": { + "sub_technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "cpid" + "name" ] }, { "required": [ - "pid" + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" ] }, { @@ -5631,140 +5523,178 @@ } ], "properties": { - "ancestry": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { "items": { - "$ref": "#/$defs/process_entity" + "type": "string" }, - "title": "Ancestry", + "title": "Labels", "type": "array" }, - "cmd_line": { - "title": "Command Line", + "name": { + "title": "Name", "type": "string" }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + "network_driver": { + "title": "Network Driver", + "type": "string" }, - "cpid": { - "title": "Common Process Identifier", + "orchestrator": { + "title": "Orchestrator", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "pod_uuid": { + "title": "Pod UUID", + "type": "string" }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" + "runtime": { + "title": "Runtime", + "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "File" + "size": { + "title": "Size", + "type": "integer" }, - "hosted_services": { + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { "items": { - "$ref": "#/$defs/win_win_service" + "$ref": "#/$defs/key_value_object" }, - "title": "Hosted Services", + "title": "Tags", "type": "array" }, - "integrity": { - "title": "Integrity", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" }, - "lineage": { + "classifications": { "items": { "type": "string" }, - "title": "Lineage", + "title": "Classifications", "type": "array" }, - "loaded_modules": { + "cves": { "items": { - "type": "string" + "$ref": "#/$defs/cve" }, - "title": "Loaded Modules", + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", "type": "array" }, "name": { "title": "Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", + "num_infected": { + "title": "Number of Infected Entities", "type": "integer" }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, "path": { "title": "Path", "type": "string" }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", + "provider": { + "title": "Provider", "type": "string" }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" + "severity": { + "title": "Severity", + "type": "string" }, - "tid": { - "title": "Thread ID", + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, - "title": "Process", + "required": [ + "classification_ids" + ], + "title": "Malware", "type": "object" }, - "process_entity": { + "win_win_service": { "additionalProperties": false, "anyOf": [ { @@ -5774,27 +5704,32 @@ }, { "required": [ - "cpid" + "service_category_id" ] }, { "required": [ - "name" + "service_dependencies" ] }, { "required": [ - "path" + "service_error_control_id" ] }, { "required": [ - "pid" + "service_start_name" ] }, { "required": [ - "uid" + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" ] } ], @@ -5803,154 +5738,180 @@ "title": "Command Line", "type": "string" }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "service_category": { + "title": "Service Category", "type": "string" }, - "pid": { - "title": "Process ID", + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" }, - "lang": { - "title": "Language", + "service_error_control": { + "title": "Service Error Control", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" }, - "path": { - "title": "Path", - "type": "string" + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" }, - "uid": { - "title": "Unique ID", + "service_start_name": { + "title": "Service Start Name", "type": "string" }, - "url_string": { - "title": "URL String", + "service_start_type": { + "title": "Service Start Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" }, - "version": { - "title": "Version", + "service_type": { + "title": "Service Type", "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "uid" + "name" ], - "title": "Programmatic Credential", + "title": "Windows Service", "type": "object" }, - "remediation": { + "group": { "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "desc": { "title": "Description", "type": "string" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "domain": { + "title": "Domain", + "type": "string" }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "references": { + "privileges": { "items": { "type": "string" }, - "title": "References", + "title": "Privileges", "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "required": [ - "desc" - ], - "title": "Remediation", + "title": "Group", "type": "object" }, - "reporter": { + "device": { "additionalProperties": false, "anyOf": [ { @@ -5958,6 +5919,21 @@ "hostname" ] }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, { "required": [ "ip" @@ -5975,183 +5951,204 @@ } ], "properties": { - "hostname": { - "title": "Hostname", + "region": { + "title": "Region", "type": "string" }, - "ip": { - "title": "IP Address", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "name": { - "title": "Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "interface_uid": { + "title": "Network Interface ID", + "type": "string" }, - "uid": { - "title": "Unique ID", + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" }, - "provider": { - "title": "Provider", + "os_machine_uuid": { + "title": "OS Machine UUID", "type": "string" }, - "score": { - "title": "Reputation Score", + "hypervisor": { + "title": "Hypervisor", "type": "string" }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" }, - "data": { - "title": "Data" + "mac": { + "title": "MAC Address", + "type": "string" }, - "flags": { + "imei_list": { "items": { "type": "string" }, - "title": "Flags", + "title": "IMEI List", "type": "array" }, - "uid": { - "title": "Unique ID", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "resource_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" + "image": { + "$ref": "#/$defs/image", + "title": "Image" }, "created_time": { "title": "Created Time", "type": "integer" }, - "criticality": { - "title": "Criticality", - "type": "string" - }, - "data": { - "title": "Data" + "is_shared": { + "title": "Shared Device", + "type": "boolean" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "hostname": { - "title": "Hostname", + "meid": { + "title": "MEID", "type": "string" }, - "ip": { - "title": "IP Address", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" + "zone": { + "title": "Network Zone", + "type": "string" }, - "labels": { + "groups": { "items": { - "type": "string" + "$ref": "#/$defs/group" }, - "title": "Labels", + "title": "Groups", "type": "array" }, - "modified_time": { - "title": "Modified Time", + "risk_score": { + "title": "Risk Score", "type": "integer" }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, "name": { "title": "Name", "type": "string" }, - "namespace": { - "title": "Namespace", + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, "owner": { "$ref": "#/$defs/user", "title": "Owner" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" + "boot_time": { + "title": "Boot Time", + "type": "integer" }, - "role": { - "title": "Role", - "type": "string" + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" }, - "role_id": { + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "risk_level_id": { "enum": [ 0, 1, @@ -6160,136 +6157,184 @@ 4, 99 ], - "title": "Role ID", + "title": "Risk Level ID", "type": "integer" }, - "tags": { + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/network_interface" }, - "title": "Tags", + "title": "Network Interfaces", "type": "array" }, - "type": { - "title": "Type", + "autoscale_uid": { + "title": "Autoscale UID", "type": "string" }, - "uid": { - "title": "Unique ID", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "subnet": { + "title": "Subnet", "type": "string" }, - "version": { - "title": "Version", + "eid": { + "title": "EID", "type": "string" - } - }, - "title": "Resource Details", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" }, - "containers": { + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { "items": { - "$ref": "#/$defs/container" + "$ref": "#/$defs/agent" }, - "title": "Containers", + "title": "Agent List", "type": "array" }, - "data": { - "title": "Data" + "ip": { + "title": "IP Address", + "type": "string" }, - "error": { - "title": "Error Code", + "hostname": { + "title": "Hostname", "type": "string" }, - "error_message": { - "title": "Error Message", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" }, - "message": { - "title": "Message", + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "title": "Response Elements", + "required": [ + "type_id" + ], + "title": "Device", "type": "object" }, - "rule": { + "campaign": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] + "properties": { + "name": { + "title": "Name", + "type": "string" } + }, + "required": [ + "name" ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, "properties": { - "category": { - "title": "Category", + "caption": { + "title": "Caption", "type": "string" }, - "desc": { - "title": "Description", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "uid": { + "title": "CWE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CWE", + "type": "object" + }, + "digital_signature": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "developer_uid": { + "title": "Developer UID", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" }, - "type": { - "title": "Type", + "state": { + "title": "State", "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" } }, "required": [ - "name", - "type" + "algorithm_id" ], - "title": "Subject Alternative Name", + "title": "Digital Signature", "type": "object" }, "sbom": { @@ -6345,14 +6390,54 @@ "title": "Software Bill of Materials", "type": "object" }, - "scim": { + "malware_scan_info": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "end_time": { + "title": "End Time", + "type": "integer" + }, + "name": { + "title": "Name", "type": "string" }, - "auth_protocol_id": { + "num_files": { + "title": "Scanned Files", + "type": "integer" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, @@ -6362,126 +6447,334 @@ 5, 6, 7, - 8, - 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", + "title": "Type ID", "type": "integer" }, - "created_time": { - "title": "Created Time", + "uid": { + "title": "Scan UID", + "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" + } + }, + "required": [ + "type_id" + ], + "title": "Malware Scan Info", + "type": "object" + }, + "kill_chain_phase": { + "additionalProperties": false, + "properties": { + "phase": { + "title": "Kill Chain Phase", + "type": "string" + }, + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "error_message": { - "title": "Last Error Message", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" + "ou_name": { + "title": "Org Unit Name", + "type": "string" }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" + "ou_uid": { + "title": "Org Unit ID", + "type": "string" }, - "last_run_time": { - "title": "Last Sync Time", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Organization", + "type": "object" + }, + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", "type": "integer" }, - "modified_time": { - "title": "Modified Time", + "key_length": { + "title": "Encryption Key Length", "type": "integer" }, - "name": { - "title": "Name", + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "log_level": { + "title": "Log Level", "type": "string" }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" + "log_name": { + "title": "Log Name", + "type": "string" }, - "scim_group_schema": { - "title": "SCIM Group Schema" + "log_provider": { + "title": "Log Provider", + "type": "string" }, - "scim_user_schema": { - "title": "SCIM User Schema" + "log_version": { + "title": "Log Version", + "type": "string" }, - "state": { - "title": "State", + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", "type": "string" }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "External ID", + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "url_string": { - "title": "SCIM Endpoint URL", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Service Provider", + "uid": { + "title": "Unique ID", "type": "string" }, "version": { - "title": "SCIM Version", + "title": "Version", "type": "string" } }, - "title": "SCIM", + "title": "Feature", "type": "object" }, - "script": { + "timespan": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "duration" + ] + }, + { + "required": [ + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" + ] + } + ], "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" + "duration": { + "title": "Duration Milliseconds", + "type": "integer" }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" + "duration_days": { + "title": "Duration Days", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "duration_hours": { + "title": "Duration Hours", + "type": "integer" }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" }, "type": { - "title": "Type", + "title": "Time Span Type", "type": "string" }, "type_id": { @@ -6494,24 +6787,18 @@ 5, 6, 7, + 8, + 9, 99 ], - "title": "Type ID", + "title": "Time Span Type ID", "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" } }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", + "title": "Time Span", "type": "object" }, - "service": { + "rule": { "additionalProperties": false, "anyOf": [ { @@ -6526,93 +6813,32 @@ } ], "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", + "category": { + "title": "Category", "type": "string" }, - "expiration_reason": { - "title": "Expiration Reason", + "desc": { + "title": "Description", "type": "string" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", + "name": { + "title": "Name", "type": "string" }, - "terminal": { - "title": "Terminal", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", + "version": { + "title": "Version", "type": "string" } }, - "title": "Session", + "title": "Rule", "type": "object" }, "software_component": { @@ -6682,62 +6908,37 @@ "title": "Software Component", "type": "object" }, - "span": { + "agent": { "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "uid": { - "title": "Unique ID", - "type": "string" + { + "required": [ + "uid" + ] } - }, - "required": [ - "end_time", - "start_time", - "uid" ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "name": { + "title": "Agent Name", "type": "string" }, - "auth_protocol_id": { + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, @@ -6749,146 +6950,128 @@ 7, 8, 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", + "title": "Type ID", "type": "integer" }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" + "uid": { + "title": "Agent ID", + "type": "string" }, - "login_endpoint": { - "title": "SSO Login Endpoint", + "uid_alt": { + "title": "Alternate Agent ID", "type": "string" }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", + "version": { + "title": "Agent Version", "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "modified_time": { - "title": "Modified Time", + "created_time": { + "title": "Registered At", "type": "integer" }, - "name": { - "title": "Name", + "dnssec_status": { + "title": "DNSSEC Status", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", "type": "string" }, - "scopes": { + "domain_contacts": { "items": { - "type": "string" + "$ref": "#/$defs/domain_contact" }, - "title": "Scopes", + "title": "Domain Contacts", "type": "array" }, - "uid": { - "title": "Unique ID", + "email_addr": { + "title": "Registrar Abuse Email Address", "type": "string" }, - "vendor_name": { - "title": "Service Provider", + "isp": { + "title": "ISP Name", "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", + "registrar": { + "title": "Domain Registrar", "type": "string" }, - "src_url": { - "title": "Source URL", + "status": { + "title": "Domain Status", "type": "string" }, - "uid": { - "title": "Unique ID", + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", "type": "string" } }, - "title": "MITRE Tactic", + "title": "WHOIS", "type": "object" }, - "technique": { + "key_value_object": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "value" ] }, { "required": [ - "uid" + "values" ] } ], @@ -6897,476 +7080,220 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", + "value": { + "title": "Value", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" } }, "required": [ "name" ], - "title": "Threat Actor", + "title": "Key:Value object", "type": "object" }, - "timespan": { + "metadata": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" + "log_format": { + "title": "Log Source Format", + "type": "string" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" }, - "type": { - "title": "Time Span Type", + "uid": { + "title": "Event UID", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "original_event_uid": { + "title": "Original Event ID", + "type": "string" }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" + "log_name": { + "title": "Log Name", + "type": "string" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", + "log_level": { + "title": "Log Level", "type": "string" }, "type": { "title": "Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", + "type": "integer" }, - "zone": { - "title": "Network Zone", + "log_source": { + "title": "Log Source", "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" }, - "end_time": { - "title": "End Time", + "logged_time": { + "title": "Logged Time", "type": "integer" }, - "flags": { + "debug": { "items": { "type": "string" }, - "title": "Flags", + "title": "Debug Information", "type": "array" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" }, - "uid": { - "title": "Unique ID", + "log_provider": { + "title": "Log Provider", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", + "event_code": { + "title": "Event Code", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "time": { - "title": "Event Time", - "type": "integer" + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" }, - "uid": { - "title": "Unique ID", + "correlation_uid": { + "title": "Correlation UID", "type": "string" }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { + "labels": { "items": { "type": "string" }, - "title": "Website Categorization", + "title": "Labels", "type": "array" }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" + "sequence": { + "title": "Sequence Number", + "type": "integer" }, - "domain": { - "title": "Domain", - "type": "string" + "transmit_time": { + "title": "Transmission Time", + "type": "integer" }, - "hostname": { - "title": "Hostname", - "type": "string" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "path": { - "title": "Path", + "original_time": { + "title": "Original Time", "type": "string" }, - "port": { - "title": "Port", - "type": "integer" + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" }, - "query_string": { - "title": "HTTP Query String", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" }, - "resource_type": { - "title": "Resource Type", + "desc": { + "title": "Description", "type": "string" }, - "scheme": { - "title": "Scheme", + "name": { + "title": "Name", "type": "string" }, - "subdomain": { - "title": "Subdomain", + "type": { + "title": "Type", "type": "string" }, - "url_string": { - "title": "URL String", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Uniform Resource Locator", + "required": [ + "uid" + ], + "title": "Node", "type": "object" }, - "user": { + "product": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "account" - ] - }, { "required": [ "name" @@ -7379,549 +7306,622 @@ } ], "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "display_name": { - "title": "Display Name", + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", "type": "string" }, - "domain": { - "title": "Domain", + "name": { + "title": "Name", "type": "string" }, - "email_addr": { - "title": "Email Address", + "path": { + "title": "Path", "type": "string" }, - "forward_addr": { - "title": "Forwarding Address", + "uid": { + "title": "Unique ID", "type": "string" }, - "full_name": { - "title": "Full Name", + "url_string": { + "title": "URL String", "type": "string" }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" + "vendor_name": { + "title": "Vendor Name", + "type": "string" }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" + "bulletin": { + "title": "Patch Bulletin", + "type": "string" }, - "name": { - "title": "Name", + "classification": { + "title": "Classification", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "phone_number": { - "title": "Telephone Number", + "desc": { + "title": "Description", "type": "string" }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", + "install_state": { + "title": "Install State", "type": "string" }, - "risk_level_id": { + "install_state_id": { "enum": [ 0, 1, 2, 3, - 4, 99 ], - "title": "Risk Level ID", + "title": "Install State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", "type": "integer" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", "type": "string" } }, - "title": "User", + "required": [ + "uid" + ], + "title": "Advisory", "type": "object" }, - "vulnerability": { + "network_endpoint": { "additionalProperties": false, - "oneOf": [ + "anyOf": [ { - "not": { - "required": [ - "cve", - "cwe" - ] - }, "required": [ - "advisory" + "domain" ] }, { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, "required": [ - "cve" + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" ] }, { - "not": { - "required": [ - "advisory", - "cve" - ] - }, "required": [ - "cwe" + "uid" ] } ], "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" + "interface_name": { + "title": "Network Interface Name", + "type": "string" }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" + "uid": { + "title": "Unique ID", + "type": "string" }, - "category": { - "title": "Category", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "port": { + "title": "Port", + "type": "integer" }, - "dependency_chain": { - "title": "Dependency Chain", + "type": { + "title": "Type", "type": "string" }, - "desc": { - "title": "Description", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" + "mac": { + "title": "MAC Address", + "type": "string" }, - "exploit_ref_url": { - "title": "Exploit URL", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", "type": "string" }, - "exploit_requirement": { - "title": "Exploit Requirement", + "isp": { + "title": "ISP Name", "type": "string" }, - "exploit_type": { - "title": "Exploit Type", + "zone": { + "title": "Network Zone", "type": "string" }, - "first_seen_time": { - "title": "First Seen", + "name": { + "title": "Name", + "type": "string" + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - "fix_coverage": { - "title": "Fix Coverage", + "svc_name": { + "title": "Service Name", "type": "string" }, - "fix_coverage_id": { + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Fix Coverage ID", + "title": "Type ID", "type": "integer" }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" + "network_scope": { + "title": "Network Scope", + "type": "string" }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "kb_articles": { + "intermediate_ips": { "items": { "type": "string" }, - "title": "Knowledgebase Articles", + "title": "Intermediate IP Addresses", "type": "array" }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "isp_org": { + "title": "ISP Org", + "type": "string" }, - "packages": { + "fingerprints": { "items": { - "$ref": "#/$defs/package" + "$ref": "#/$defs/fingerprint" }, - "title": "Software Packages", + "title": "Fingerprints", "type": "array" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "vpc_uid": { + "title": "VPC UID", + "type": "string" }, - "related_vulnerabilities": { + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { "items": { - "type": "string" + "$ref": "#/$defs/agent" }, - "title": "Related Vulnerability IDs", + "title": "Agent List", "type": "array" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "ip": { + "title": "IP Address", + "type": "string" }, - "severity": { - "title": "Severity", + "hostname": { + "title": "Hostname", "type": "string" }, - "title": { - "title": "Title", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "title": "Vulnerability Details", + "title": "Network Endpoint", "type": "object" }, - "whois": { + "d3f_tactic": { "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "anyOf": [ + { + "required": [ + "name" + ] }, - "created_time": { - "title": "Registered At", - "type": "integer" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" }, - "dnssec_status": { - "title": "DNSSEC Status", + "src_url": { + "title": "Source URL", "type": "string" }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", "type": "integer" }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { + "cvss": { "items": { - "$ref": "#/$defs/domain_contact" + "$ref": "#/$defs/cvss" }, - "title": "Domain Contacts", + "title": "CVSS Score", "type": "array" }, - "email_addr": { - "title": "Registrar Abuse Email Address", + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", "type": "string" }, - "isp": { - "title": "ISP Name", + "cwe_url": { + "title": "CWE URL", "type": "string" }, - "isp_org": { - "title": "ISP Org", + "desc": { + "title": "Description", "type": "string" }, - "last_seen_time": { - "title": "Last Updated At", + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "name_servers": { + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { "items": { "type": "string" }, - "title": "Name Servers", + "title": "References", "type": "array" }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" }, - "registrar": { - "title": "Domain Registrar", + "title": { + "title": "Title", "type": "string" }, - "status": { - "title": "Domain Status", + "type": { + "title": "Vulnerability Type", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", + "uid": { + "title": "CVE ID", "type": "string" } }, - "title": "WHOIS", + "required": [ + "uid" + ], + "title": "CVE", "type": "object" }, - "win_win_service": { + "domain_contact": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" }, - { - "required": [ - "service_category_id" - ] + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" }, - { - "required": [ - "service_dependencies" - ] + "name": { + "title": "Name", + "type": "string" }, - { - "required": [ - "service_error_control_id" - ] + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "service_start_name" + "name" ] }, { "required": [ - "service_start_type_id" + "type" ] }, { "required": [ - "service_type_id" + "uid" ] } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" + "data": { + "title": "Data" }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" + "desc": { + "title": "Description", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" + "is_applied": { + "title": "Applied", + "type": "boolean" }, "name": { "title": "Name", "type": "string" }, - "service_category": { - "title": "Service Category", + "type": { + "title": "Type", "type": "string" }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", + "uid": { + "title": "Unique ID", "type": "string" }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" + "end_time": { + "title": "End Time", + "type": "integer" }, - "service_start_name": { - "title": "Service Start Name", + "message": { + "title": "Message", "type": "string" }, - "service_start_type": { - "title": "Service Start Type", + "operation": { + "title": "Operation", "type": "string" }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "status_code": { + "title": "Status Code", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "name" + "end_time", + "start_time", + "uid" ], - "title": "Windows Service", + "title": "Span", "type": "object" } }, @@ -7929,68 +7929,99 @@ "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Activity ID", - "type": "integer" + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" }, - "activity_name": { - "title": "Activity", + "message": { + "title": "Message", "type": "string" }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" }, "api": { "$ref": "#/$defs/api", "title": "API Details" }, - "category_name": { - "title": "Category", + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", "type": "string" }, - "category_uid": { - "const": 6, - "title": "Category ID", - "type": "integer" + "status_code": { + "title": "Status Code", + "type": "string" }, - "class_name": { - "title": "Class", + "type_name": { + "title": "Type Name", "type": "string" }, - "class_uid": { - "const": 6003, - "title": "Class ID", + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", "type": "integer" }, - "count": { - "title": "Count", + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", "type": "integer" }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "status": { + "title": "Status", + "type": "string" }, - "end_time": { - "title": "End Time", + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", "type": "integer" }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, "enrichments": { "items": { "$ref": "#/$defs/enrichment" @@ -8002,48 +8033,51 @@ "$ref": "#/$defs/http_request", "title": "HTTP Request" }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" }, - "message": { - "title": "Message", - "type": "string" + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" + "activity_name": { + "title": "Activity", + "type": "string" }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "raw_data": { - "title": "Raw Data", + "class_name": { + "title": "Class", "type": "string" }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" }, "raw_data_size": { "title": "Raw Data Size", "type": "integer" }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Resources Array", - "type": "array" + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, "severity": { "title": "Severity", "type": "string" }, + "category_name": { + "title": "Category", + "type": "string" + }, "severity_id": { "enum": [ 0, @@ -8058,59 +8092,25 @@ "title": "Severity ID", "type": "integer" }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", + "count": { + "title": "Count", "type": "integer" }, - "timezone_offset": { - "title": "Timezone Offset", + "end_time": { + "title": "End Time", "type": "integer" }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, "type_uid": { "title": "Type ID", "type": "integer" }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" } }, "required": [ diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json index 2d5ab8351c..1c2e700d12 100644 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+security_control+trace.json @@ -1,11 +1,11 @@ { "$defs": { - "account": { + "kb_article": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "src_url" ] }, { @@ -14,152 +14,6 @@ ] } ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, "properties": { "avg_timespan": { "$ref": "#/$defs/timespan", @@ -177,10 +31,6 @@ "title": "Created Time", "type": "integer" }, - "desc": { - "title": "Description", - "type": "string" - }, "install_state": { "title": "Install State", "type": "string" @@ -200,10 +50,6 @@ "title": "The patch is superseded.", "type": "boolean" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "os": { "$ref": "#/$defs/os", "title": "OS" @@ -212,26 +58,9 @@ "$ref": "#/$defs/product", "title": "Product" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, "size": { "title": "Size", @@ -246,247 +75,238 @@ "type": "string" }, "uid": { - "title": "Advisory ID", + "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Advisory", + "title": "KB Article", "type": "object" }, - "affected_code": { + "long_string": { "additionalProperties": false, "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "start_column": { - "title": "Start Column", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "file" + "value" ], - "title": "Affected Code", + "title": "Long String", "type": "object" }, - "affected_package": { + "enrichment": { "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpe_name": { - "title": "The product CPE identifier", + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "fixed_in_version": { - "title": "Fixed In Version", + "provider": { + "title": "Provider", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "license": { - "title": "Software License", + "short_desc": { + "title": "Short Description", "type": "string" }, - "license_url": { - "title": "Software License URL", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "type": { + "title": "Type", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", "type": "string" }, - "path": { - "title": "Path", + "display_name": { + "title": "Display Name", "type": "string" }, - "purl": { - "title": "Package URL", + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", "type": "string" }, - "release": { - "title": "Software Release Details", + "given_name": { + "title": "Given Name", "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "hire_time": { + "title": "Hire Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "job_title": { + "title": "Job Title", "type": "string" }, - "type": { - "title": "Type", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", "type": "integer" }, - "uid": { - "title": "Package UID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "version": { - "title": "Version", + "surname": { + "title": "Surname", "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" } }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", + "title": "LDAP Person", "type": "object" }, - "agent": { + "email_auth": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Agent Name", + "dkim": { + "title": "DKIM Status", "type": "string" }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", + "dkim_domain": { + "title": "DKIM Domain", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" }, - "uid": { - "title": "Agent ID", + "dmarc": { + "title": "DMARC Status", "type": "string" }, - "uid_alt": { - "title": "Alternate Agent ID", + "dmarc_override": { + "title": "DMARC Override", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "dmarc_policy": { + "title": "DMARC Policy", "type": "string" }, - "version": { - "title": "Agent Version", + "spf": { + "title": "SPF Status", "type": "string" } }, - "title": "Agent", + "title": "Email Authentication", "type": "object" }, - "ai_model": { + "epss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "ai_provider": { - "title": "AI Provider", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "percentile": { + "title": "EPSS Percentile", + "type": "number" }, - "uid": { - "title": "Unique ID", + "score": { + "title": "EPPS Score", "type": "string" }, "version": { @@ -495,54 +315,35 @@ } }, "required": [ - "ai_provider" + "score" ], - "title": "AI Model", + "title": "EPSS", "type": "object" }, - "analytic": { + "device_hw_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", + "bios_manufacturer": { + "title": "BIOS Manufacturer", "type": "string" }, - "desc": { - "title": "Description", + "bios_ver": { + "title": "BIOS Version", "type": "string" }, - "name": { - "title": "Name", + "chassis": { + "title": "Chassis", "type": "string" }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", + "cpu_architecture": { + "title": "CPU Architecture", "type": "string" }, - "state_id": { + "cpu_architecture_id": { "enum": [ 0, 1, @@ -550,93 +351,111 @@ 3, 99 ], - "title": "State ID", + "title": "CPU Architecture ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", + "cpu_cores": { + "title": "CPU Cores", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "cpu_count": { + "title": "CPU Count", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" }, - "operation": { - "title": "Operation", + "cpu_type": { + "title": "Processor Type", "type": "string" }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" + "gpu_count": { + "title": "GPU Count", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" }, - "version": { - "title": "Version", + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "required": [ - "operation" - ], - "title": "API", + "title": "Device Hardware Info", "type": "object" }, - "application": { + "network_proxy": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -644,166 +463,130 @@ } ], "properties": { - "criticality": { - "title": "Business Criticality", - "type": "string" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "data": { - "title": "Data" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "desc": { - "title": "Application Description", + "domain": { + "title": "Domain", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" }, "hostname": { "title": "Hostname", "type": "string" }, - "labels": { + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { "items": { "type": "string" }, - "title": "Labels", + "title": "Intermediate IP Addresses", "type": "array" }, - "name": { - "title": "Application Name", + "ip": { + "title": "IP Address", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Application Relationship" + "isp": { + "title": "ISP Name", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "sbom": { - "$ref": "#/$defs/sbom", - "title": "Related SBOM" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Application Type", + "mac": { + "title": "MAC Address", "type": "string" }, - "uid": { - "title": "Application ID", + "mac_vendor": { + "title": "MAC Vendor", "type": "string" }, - "uid_alt": { - "title": "Application Alternative ID", + "name": { + "title": "Name", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Application Version", + "network_scope": { + "title": "Network Scope", "type": "string" - } - }, - "title": "Application", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] }, - { - "required": [ - "tactic" - ] + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" + "port": { + "title": "Port", + "type": "integer" }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" }, - "version": { - "title": "Version", + "subnet_uid": { + "title": "Subnet UID", "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" }, - "email_addr": { - "title": "Email Address", + "svc_name": { + "title": "Service Name", "type": "string" }, - "factor_type": { - "title": "Factor Type", + "type": { + "title": "Type", "type": "string" }, - "factor_type_id": { + "type_id": { "enum": [ 0, 1, @@ -817,237 +600,189 @@ 9, 10, 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Factor Type ID", + "title": "Type ID", "type": "integer" }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", + "uid": { + "title": "Unique ID", "type": "string" }, - "provider": { - "title": "Provider", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Authorization Result", + "title": "Network Proxy Endpoint", "type": "object" }, - "autonomous_system": { + "data_classification": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "category_id" ] }, { "required": [ - "number" + "confidentiality_id" ] } ], "properties": { - "name": { - "title": "Name", + "category": { + "title": "Category", "type": "string" }, - "number": { - "title": "Number", + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" }, - "expiration_time": { - "title": "Expiration Time", + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", "type": "integer" }, - "fingerprints": { + "discovery_details": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/discovery_details" }, - "title": "Fingerprints", + "title": "Discovery Details", "type": "array" }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" + "size": { + "title": "Size", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", + "status": { + "title": "Status", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "total": { + "title": "Total", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" } }, - "required": [ - "type" - ], - "title": "Classifier Details", + "title": "Data Classification", "type": "object" }, - "cloud": { + "http_response": { "additionalProperties": false, "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" + "body_length": { + "title": "Response Body Length", + "type": "integer" }, - "cloud_partition": { - "title": "Cloud Partition", + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "project_uid": { - "title": "Project ID", - "type": "string" + "latency": { + "title": "Latency", + "type": "integer" }, - "provider": { - "title": "Cloud Provider", - "type": "string" + "length": { + "title": "Response Length", + "type": "integer" }, - "region": { - "title": "Region", + "message": { + "title": "Message", "type": "string" }, - "zone": { - "title": "Cloud Availability Zone", + "status": { + "title": "Status", "type": "string" } }, "required": [ - "provider" + "code" ], - "title": "Cloud", + "title": "HTTP Response", "type": "object" }, - "container": { + "resource_details": { "additionalProperties": false, "anyOf": [ { @@ -1062,13 +797,39 @@ } ], "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" }, "labels": { "items": { @@ -1077,34 +838,42 @@ "title": "Labels", "type": "array" }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "network_driver": { - "title": "Network Driver", + "namespace": { + "title": "Namespace", "type": "string" }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" }, - "runtime": { - "title": "Runtime", + "role": { + "title": "Role", "type": "string" }, - "size": { - "title": "Size", + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", "type": "integer" }, - "tag": { - "title": "Image Tag", - "type": "string" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -1112,167 +881,262 @@ "title": "Tags", "type": "array" }, + "type": { + "title": "Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Container", + "title": "Resource Details", "type": "object" }, - "cve": { + "display": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "color_depth": { + "title": "Color Depth", "type": "integer" }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" + "physical_height": { + "title": "Physical Height", + "type": "integer" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" + "physical_width": { + "title": "Physical Width", + "type": "integer" }, - "cwe_url": { - "title": "CWE URL", + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "desc": { - "title": "Description", + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", "type": "string" }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "name": { + "title": "Name", + "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "protocol_name": { + "title": "Supported Protocol", + "type": "string" }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "rate_limit": { + "title": "Rate Limit", + "type": "integer" }, - "title": { - "title": "Title", + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" }, "type": { - "title": "Vulnerability Type", + "title": "Type", "type": "string" }, "uid": { - "title": "CVE ID", + "title": "Unique ID", "type": "string" } }, "required": [ "uid" ], - "title": "CVE", + "title": "Programmatic Credential", "type": "object" }, - "cvss": { + "os": { "additionalProperties": false, "properties": { - "base_score": { - "title": "Base Score", - "type": "number" + "build": { + "title": "OS Build", + "type": "string" }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", + "country": { + "title": "Country", "type": "string" }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" }, - "overall_score": { - "title": "Overall Score", - "type": "number" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "severity": { - "title": "Severity", + "edition": { + "title": "OS Edition", "type": "string" }, - "src_url": { - "title": "Source URL", + "kernel_release": { + "title": "Kernel Release", "type": "string" }, - "vector_string": { - "title": "Vector String", + "lang": { + "title": "Language", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "name": { + "title": "Name", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", + "sp_name": { + "title": "OS Service Pack", "type": "string" }, - "src_url": { - "title": "Source URL", + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "uid": { - "title": "CWE ID", + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, "required": [ - "uid" + "name", + "type_id" ], - "title": "CWE", + "title": "Operating System (OS)", "type": "object" }, - "d3f_tactic": { + "tactic": { "additionalProperties": false, "anyOf": [ { @@ -1300,91 +1164,101 @@ "type": "string" } }, - "title": "MITRE D3FEND\u2122 Tactic", + "title": "MITRE Tactic", "type": "object" }, - "d3f_technique": { + "dns_answer": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "class": { + "title": "Resource Record Class", "type": "string" }, - "src_url": { - "title": "Source URL", + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", "type": "string" }, - "uid": { - "title": "Unique ID", + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", "type": "string" } }, - "title": "MITRE D3FEND\u2122 Technique", + "required": [ + "rdata" + ], + "title": "DNS Answer", "type": "object" }, - "d3fend": { + "discovery_details": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" + "count": { + "title": "Count", + "type": "integer" }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" }, - "version": { - "title": "Version", + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", "type": "string" } }, - "title": "MITRE D3FEND\u2122", + "title": "Discovery Details", "type": "object" }, - "data_classification": { + "sso": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], "properties": { - "category": { - "title": "Category", + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "category_id": { + "auth_protocol_id": { "enum": [ 0, 1, @@ -1393,114 +1267,247 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, 99 ], - "title": "Category ID", + "title": "Auth Protocol ID", "type": "integer" }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "duration_mins": { + "title": "SSO Session Duration", "type": "integer" }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" }, - "size": { - "title": "Size", + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "src_url": { - "title": "Source URL", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "status_details": { + "scopes": { "items": { "type": "string" }, - "title": "Status Details", + "title": "Scopes", "type": "array" }, - "status_id": { + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Data Classification", + "title": "Token", "type": "object" }, - "device": { + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "d3f_tactic" ] }, { "required": [ - "instance_uid" + "d3f_technique" ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" }, - { - "required": [ - "interface_name" - ] + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" }, - { - "required": [ - "interface_uid" - ] + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" }, - { - "required": [ - "ip" - ] + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ { "required": [ "name" @@ -1513,199 +1520,192 @@ } ], "properties": { - "agent_list": { + "countermeasures": { "items": { - "$ref": "#/$defs/agent" + "$ref": "#/$defs/d3fend" }, - "title": "Agent List", + "title": "Countermeasures", "type": "array" }, - "autoscale_uid": { - "title": "Autoscale UID", + "name": { + "title": "Name", "type": "string" }, - "boot_time": { - "title": "Boot Time", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "boot_uid": { - "title": "Boot UID", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] }, - "created_time": { - "title": "Created Time", - "type": "integer" + { + "required": [ + "country" + ] }, - "desc": { - "title": "Description", - "type": "string" + { + "required": [ + "postal_code" + ] }, - "domain": { - "title": "Domain", + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", "type": "string" }, - "eid": { - "title": "EID", + "city": { + "title": "City", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" + "continent": { + "title": "Continent", + "type": "string" }, - "groups": { + "coordinates": { "items": { - "$ref": "#/$defs/group" + "type": "number" }, - "title": "Groups", + "title": "Coordinates", "type": "array" }, - "hostname": { - "title": "Hostname", + "country": { + "title": "Country", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "desc": { + "title": "Description", + "type": "string" }, - "hypervisor": { - "title": "Hypervisor", + "geodetic_altitude": { + "title": "Geodetic Altitude", "type": "string" }, - "iccid": { - "title": "ICCID", + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", "type": "string" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "geohash": { + "title": "Geohash", + "type": "string" }, - "imei": { - "title": "IMEI", + "horizontal_accuracy": { + "title": "Horizontal Accuracy", "type": "string" }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" }, - "instance_uid": { - "title": "Instance ID", + "isp": { + "title": "ISP Name", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" + "lat": { + "title": "Latitude", + "type": "number" }, - "interface_uid": { - "title": "Network Interface ID", + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", "type": "string" }, - "ip": { - "title": "IP Address", + "pressure_altitude": { + "title": "Pressure Altitude", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" + "provider": { + "title": "Provider", + "type": "string" }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" }, - "mac": { - "title": "MAC Address", + "domain": { + "title": "Domain", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" }, - "meid": { - "title": "MEID", - "type": "string" + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" }, - "model": { - "title": "Model", + "issuer": { + "title": "Issuer Details", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" }, - "region": { - "title": "Region", - "type": "string" + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" }, - "risk_level": { - "title": "Risk Level", + "state": { + "title": "State", "type": "string" }, - "risk_level_id": { + "state_id": { "enum": [ 0, 1, @@ -1714,26 +1714,45 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "subnet": { - "title": "Subnet", + "uid": { + "title": "Unique ID", "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "url_string": { + "title": "Configuration URL", "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] }, - "type": { - "title": "Type", + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", "type": "string" }, - "type_id": { + "ai_role_id": { "enum": [ 0, 1, @@ -1742,371 +1761,497 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "AI Role ID", "type": "integer" }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" + "application": { + "$ref": "#/$defs/application", + "title": "Application" }, - "uid": { - "title": "Unique ID", - "type": "string" + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" }, - "uid_alt": { - "title": "Alternate ID", + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "total_tokens": { + "title": "Total Tokens", + "type": "integer" }, - "zone": { - "title": "Network Zone", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Device", + "title": "Message Context", "type": "object" }, - "device_hw_info": { + "process": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "bios_ver": { - "title": "BIOS Version", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "chassis": { - "title": "Chassis", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpu_architecture": { - "title": "CPU Architecture", + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", "type": "string" }, - "cpu_architecture_id": { + "integrity_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, 99 ], - "title": "CPU Architecture ID", + "title": "Integrity Level", "type": "integer" }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" }, - "cpu_type": { - "title": "Processor Type", + "path": { + "title": "Path", "type": "string" }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" + "pid": { + "title": "Process ID", + "type": "integer" }, - "gpu_count": { - "title": "GPU Count", + "ptid": { + "title": "Process Thread ID", "type": "integer" }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" + "sandbox": { + "title": "Sandbox", + "type": "string" }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "ram_size": { - "title": "RAM Size", + "terminated_time": { + "title": "Terminated Time", "type": "integer" }, - "serial_number": { - "title": "Serial Number", - "type": "string" + "tid": { + "title": "Thread ID", + "type": "integer" }, - "uuid": { - "title": "UUID", + "uid": { + "title": "Unique ID", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" } }, - "title": "Device Hardware Info", + "title": "Process", "type": "object" }, - "digital_signature": { + "vulnerability": { "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], "properties": { - "algorithm": { - "title": "Algorithm", + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" }, - "created_time": { - "title": "Created Time", + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", "type": "integer" }, - "developer_uid": { - "title": "Developer UID", + "exploit_ref_url": { + "title": "Exploit URL", "type": "string" }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" }, - "state": { - "title": "State", + "exploit_type": { + "title": "Exploit Type", "type": "string" }, - "state_id": { + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, 99 ], - "title": "State ID", + "title": "Fix Coverage ID", "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", "type": "integer" }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" }, - "occurrences": { + "references": { "items": { - "$ref": "#/$defs/occurrence_details" + "type": "string" }, - "title": "Occurrences", + "title": "References", "type": "array" }, - "type": { - "title": "Type", + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", "type": "string" }, - "value": { - "title": "Value", + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "title": "Discovery Details", + "title": "Vulnerability Details", "type": "object" }, - "display": { + "affected_code": { "additionalProperties": false, "properties": { - "color_depth": { - "title": "Color Depth", + "end_column": { + "title": "End Column", "type": "integer" }, - "physical_height": { - "title": "Physical Height", + "end_line": { + "title": "End Line", "type": "integer" }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "physical_width": { - "title": "Physical Width", + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", "type": "integer" }, - "scale_factor": { - "title": "Scale Factor", + "start_line": { + "title": "Start Line", "type": "integer" } }, - "title": "Display", + "required": [ + "file" + ], + "title": "Affected Code", "type": "object" }, - "dns_answer": { + "keyboard_info": { "additionalProperties": false, "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", + "function_keys": { + "title": "Function Keys", "type": "integer" }, - "rdata": { - "title": "DNS RData", + "ime": { + "title": "IME", "type": "string" }, - "ttl": { - "title": "TTL", + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", "type": "integer" }, - "type": { - "title": "Resource Record Type", + "keyboard_type": { + "title": "Keyboard Type", "type": "string" } }, - "required": [ - "rdata" - ], - "title": "DNS Answer", + "title": "Keyboard Information", "type": "object" }, - "domain_contact": { + "certificate": { "additionalProperties": false, "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" }, - "phone_number": { - "title": "Phone Number", + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", "type": "string" }, - "type": { - "title": "Domain Contact Type", + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" + "subject": { + "title": "Subject Distinguished Name", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "type_id" + "issuer", + "serial_number" ], - "title": "Domain Contact", + "title": "Digital Certificate", "type": "object" }, - "edge": { + "graph": { "additionalProperties": false, "anyOf": [ { @@ -2121,8 +2266,16 @@ } ], "properties": { - "data": { - "title": "Data" + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" }, "is_directed": { "title": "Directed", @@ -2132,16 +2285,34 @@ "title": "Name", "type": "string" }, - "relation": { - "title": "Relation", - "type": "string" + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" }, - "source": { - "title": "Source", + "query_language": { + "title": "Query Language", "type": "string" }, - "target": { - "title": "Target", + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, "uid": { @@ -2150,354 +2321,290 @@ } }, "required": [ - "source", - "target" + "nodes" ], - "title": "Edge", + "title": "Graph", "type": "object" }, - "email": { + "account": { "additionalProperties": false, "anyOf": [ { "required": [ - "from" + "name" ] }, { "required": [ - "to" + "uid" ] } ], "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" + "is_disabled": { + "title": "Disabled", + "type": "boolean" }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" + "is_locked": { + "title": "Locked", + "type": "boolean" }, - "delivered_to": { - "title": "Delivered To", - "type": "string" + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" }, - "delivered_to_list": { + "labels": { "items": { "type": "string" }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", + "title": "Labels", "type": "array" }, - "from": { - "title": "From", + "name": { + "title": "Name", "type": "string" }, - "from_list": { + "tags": { "items": { - "type": "string" + "$ref": "#/$defs/key_value_object" }, - "title": "From List", + "title": "Tags", "type": "array" }, - "from_mailbox": { - "title": "From Mailbox", + "type": { + "title": "Type", "type": "string" }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" }, - "is_read": { - "title": "Read", - "type": "boolean" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "message_uid": { - "title": "Message UID", + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "raw_header": { - "title": "Raw Header", + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", "type": "string" }, - "reply_to": { - "title": "Reply To", + "type": { + "title": "Type", "type": "string" }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" }, - "sender": { - "title": "Sender", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "sender_mailbox": { - "title": "Sender Mailbox", + "expiration_reason": { + "title": "Expiration Reason", "type": "string" }, - "size": { - "title": "Size", + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "smtp_from": { - "title": "SMTP From", - "type": "string" + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" + "is_remote": { + "title": "Remote", + "type": "boolean" }, - "subject": { - "title": "Subject", + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", "type": "string" }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", + "terminal": { + "title": "Terminal", "type": "string" }, - "dmarc_override": { - "title": "DMARC Override", + "uid": { + "title": "Unique ID", "type": "string" }, - "dmarc_policy": { - "title": "DMARC Policy", + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "spf": { - "title": "SPF Status", + "uuid": { + "title": "UUID", "type": "string" } }, - "title": "Email Authentication", + "title": "Session", "type": "object" }, - "encryption_details": { + "d3f_technique": { "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "type": { - "title": "Encryption Type", - "type": "string" + { + "required": [ + "uid" + ] } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, + ], "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, "src_url": { "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", + "title": "MITRE D3FEND\u2122 Technique", "type": "object" }, - "environment_variable": { + "image": { "additionalProperties": false, "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "path": { + "title": "Path", "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" }, - "score": { - "title": "EPPS Score", + "tag": { + "title": "Image Tag", "type": "string" }, - "version": { - "title": "Version", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "score" + "uid" ], - "title": "EPSS", + "title": "Image", "type": "object" }, - "extension": { + "application": { "additionalProperties": false, "anyOf": [ { @@ -2512,129 +2619,105 @@ } ], "properties": { - "name": { - "title": "Name", + "criticality": { + "title": "Business Criticality", "type": "string" }, - "uid": { - "title": "Unique ID", + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", "type": "string" }, - "version": { - "title": "Version", + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, "name": { - "title": "Name", + "title": "Application Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { + "owner": { "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" + "title": "Owner" }, - "company_name": { - "title": "Company Name", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" }, - "confidentiality": { - "title": "Confidentiality", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "confidentiality_id": { + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Confidentiality ID", + "title": "Risk Level ID", "type": "integer" }, - "created_time": { - "title": "Created Time", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" }, - "desc": { - "title": "Description", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", "type": "string" }, - "drive_type": { - "title": "Drive Type", + "uid": { + "title": "Application ID", "type": "string" }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "ext": { - "title": "File Extension", + "version": { + "title": "Application Version", "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" }, "hashes": { "items": { @@ -2643,90 +2726,111 @@ "title": "Hashes", "type": "array" }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "internal_name": { - "title": "Internal Name", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" + "type": { + "title": "Type", + "type": "string" }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "is_system": { - "title": "System", - "type": "boolean" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" }, - "mime_type": { - "title": "MIME type", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "modified_time": { - "title": "Modified Time", + "epoch": { + "title": "Epoch", "type": "integer" }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "package_manager": { + "title": "Package Manager", + "type": "string" }, - "parent_folder": { - "title": "Parent Folder", + "package_manager_url": { + "title": "Package Manager URL", "type": "string" }, "path": { "title": "Path", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", + "purl": { + "title": "Package URL", "type": "string" }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" + "release": { + "title": "Software Release Details", + "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "src_url": { + "title": "Source URL", + "type": "string" }, "type": { "title": "Type", @@ -2737,97 +2841,54 @@ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, - 8, 99 ], "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", + "title": "Package UID", "type": "string" }, - "uri": { - "title": "File URI", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, "version": { "title": "Version", "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, "required": [ "name", - "type_id" + "version" ], - "title": "File", + "title": "Affected Software Package", "type": "object" }, - "fingerprint": { + "cis_control": { "additionalProperties": false, "properties": { - "algorithm": { - "title": "Algorithm", + "desc": { + "title": "Description", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "value": { - "title": "Value", + "version": { + "title": "Version", "type": "string" } }, "required": [ - "algorithm_id", - "value" + "name" ], - "title": "Fingerprint", + "title": "CIS Control", "type": "object" }, - "firewall_rule": { + "analytic": { "additionalProperties": false, "anyOf": [ { @@ -2842,69 +2903,49 @@ } ], "properties": { - "category": { - "title": "Category", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "condition": { - "title": "Condition", + "category": { + "title": "Category", "type": "string" }, "desc": { "title": "Description", "type": "string" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "match_details": { + "related_analytics": { "items": { - "type": "string" + "$ref": "#/$defs/analytic" }, - "title": "Match Details", + "title": "Related Analytics", "type": "array" }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", + "state": { + "title": "State", "type": "string" }, - "rate_limit": { - "title": "Rate Limit", + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", "type": "integer" }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { + "type_id": { "enum": [ 0, 1, @@ -2914,46 +2955,31 @@ 5, 6, 7, + 8, + 9, + 10, + 11, 99 ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", + "title": "Type ID", "type": "integer" }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "vram_mode": { - "title": "VRAM Mode", + "version": { + "title": "Version", "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" } }, - "title": "GPU Information", + "required": [ + "type_id" + ], + "title": "Analytic", "type": "object" }, - "graph": { + "edge": { "additionalProperties": false, "anyOf": [ { @@ -2968,16 +2994,8 @@ } ], "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "edges": { - "items": { - "$ref": "#/$defs/edge" - }, - "title": "Edges", - "type": "array" + "data": { + "title": "Data" }, "is_directed": { "title": "Directed", @@ -2987,34 +3005,16 @@ "title": "Name", "type": "string" }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" - }, - "query_language": { - "title": "Query Language", + "relation": { + "title": "Relation", "type": "string" }, - "query_language_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Query Language ID", - "type": "integer" + "source": { + "title": "Source", + "type": "string" }, - "type": { - "title": "Type", + "target": { + "title": "Target", "type": "string" }, "uid": { @@ -3023,194 +3023,166 @@ } }, "required": [ - "nodes" + "source", + "target" ], - "title": "Graph", + "title": "Edge", "type": "object" }, - "group": { + "actor": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "app_name" ] }, { "required": [ - "uid" + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" ] } ], "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", + "app_name": { + "title": "Application Name", "type": "string" }, - "name": { - "title": "Name", + "app_uid": { + "title": "Application ID", "type": "string" }, - "privileges": { + "authorizations": { "items": { - "type": "string" + "$ref": "#/$defs/authorization" }, - "title": "Privileges", + "title": "Authorization Information", "type": "array" }, - "type": { - "title": "Group Type", - "type": "string" + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" }, - "uid": { - "title": "Unique ID", + "invoked_by": { + "title": "Invoked by", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "process": { + "$ref": "#/$defs/process", + "title": "Process" }, - "value": { - "title": "Value", - "type": "string" + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" } }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", + "title": "Actor", "type": "object" }, - "http_request": { + "cloud": { "additionalProperties": false, "properties": { - "args": { - "title": "HTTP Arguments", - "type": "string" - }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", + "cloud_partition": { + "title": "Cloud Partition", "type": "string" }, - "length": { - "title": "Request Length", - "type": "integer" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "referrer": { - "title": "HTTP Referrer", + "project_uid": { + "title": "Project ID", "type": "string" }, - "uid": { - "title": "Unique ID", + "provider": { + "title": "Cloud Provider", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", + "region": { + "title": "Region", "type": "string" }, - "version": { - "title": "HTTP Version", + "zone": { + "title": "Cloud Availability Zone", "type": "string" - }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" } }, - "title": "HTTP Request", + "required": [ + "provider" + ], + "title": "Cloud", "type": "object" }, - "http_response": { + "trace": { "additionalProperties": false, "properties": { - "body_length": { - "title": "Response Body Length", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "code": { - "title": "Response Code", + "end_time": { + "title": "End Time", "type": "integer" }, - "content_type": { - "title": "HTTP Content Type", - "type": "string" - }, - "http_headers": { + "flags": { "items": { - "$ref": "#/$defs/http_header" + "type": "string" }, - "title": "HTTP Headers", + "title": "Flags", "type": "array" }, - "latency": { - "title": "Latency", - "type": "integer" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "length": { - "title": "Response Length", - "type": "integer" + "span": { + "$ref": "#/$defs/span", + "title": "Span" }, - "message": { - "title": "Message", - "type": "string" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "status": { - "title": "Status", + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "code" + "uid" ], - "title": "HTTP Response", + "title": "Trace", "type": "object" }, - "idp": { + "ai_model": { "additionalProperties": false, "anyOf": [ { @@ -3225,588 +3197,668 @@ } ], "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", + "ai_provider": { + "title": "AI Provider", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "uid": { + "title": "Unique ID", "type": "string" }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" + "is_system": { + "title": "System", + "type": "boolean" }, - "state": { - "title": "State", - "type": "string" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" }, - "state_id": { + "confidentiality_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, 99 ], - "title": "State ID", + "title": "Confidentiality ID", "type": "integer" }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" }, - "name": { - "title": "Name", - "type": "string" + "is_readonly": { + "title": "Read-Only", + "type": "boolean" }, - "path": { - "title": "Path", + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", "type": "string" }, - "tag": { - "title": "Image Tag", + "company_name": { + "title": "Company Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "attributes": { + "title": "Attributes", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "desc": { + "title": "Description", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" + "type": { + "title": "Type", + "type": "string" }, - "bulletin": { - "title": "Patch Bulletin", + "path": { + "title": "Path", "type": "string" }, - "classification": { - "title": "Classification", + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", "type": "string" }, "created_time": { "title": "Created Time", "type": "integer" }, - "install_state": { - "title": "Install State", + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", "type": "string" }, - "install_state_id": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, + 8, 99 ], - "title": "Install State ID", + "title": "Type ID", "type": "integer" }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "size": { + "title": "Size", + "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "severity": { - "title": "Severity", + "internal_name": { + "title": "Internal Name", "type": "string" }, - "size": { - "title": "Size", + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", "type": "integer" }, - "src_url": { - "title": "Source URL", + "security_descriptor": { + "title": "Security Descriptor", "type": "string" }, - "title": { - "title": "Title", + "volume": { + "title": "Volume", "type": "string" }, - "uid": { - "title": "Unique ID", + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "KB Article", + "required": [ + "name", + "type_id" + ], + "title": "File", "type": "object" }, - "key_value_object": { + "remediation": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], "properties": { - "name": { - "title": "Name", - "type": "string" + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" }, - "value": { - "title": "Value", + "desc": { + "title": "Description", "type": "string" }, - "values": { + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { "items": { "type": "string" }, - "title": "Values", + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", "type": "array" } }, "required": [ - "name" + "desc" ], - "title": "Key:Value object", + "title": "Remediation", "type": "object" }, - "keyboard_info": { + "email": { "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" + "anyOf": [ + { + "required": [ + "from" + ] }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" + { + "required": [ + "to" + ] } - }, - "required": [ - "phase_id" ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, "properties": { - "cost_center": { - "title": "Cost Center", + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" }, - "department": { - "title": "Department", + "from": { + "title": "From", "type": "string" }, - "display_name": { - "title": "Display Name", + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", "type": "string" }, - "email_addrs": { + "from_mailboxes": { "items": { "type": "string" }, - "title": "Email Addresses", + "title": "From Mailboxes", "type": "array" }, - "employee_uid": { - "title": "Employee ID", - "type": "string" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "given_name": { - "title": "Given Name", + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", "type": "string" }, - "hire_time": { - "title": "Hire Time", - "type": "integer" + "raw_header": { + "title": "Raw Header", + "type": "string" }, - "job_title": { - "title": "Job Title", + "reply_to": { + "title": "Reply To", "type": "string" }, - "labels": { + "reply_to_list": { "items": { "type": "string" }, - "title": "Labels", + "title": "Reply To List", "type": "array" }, - "last_login_time": { - "title": "Last Login", - "type": "integer" + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" }, - "ldap_cn": { - "title": "LDAP Common Name", + "return_path": { + "title": "Return Path", "type": "string" }, - "ldap_dn": { - "title": "LDAP Distinguished Name", + "sender": { + "title": "Sender", "type": "string" }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" }, - "modified_time": { - "title": "Modified Time", + "size": { + "title": "Size", "type": "integer" }, - "office_location": { - "title": "Office Location", + "smtp_from": { + "title": "SMTP From", "type": "string" }, - "phone_number": { - "title": "Telephone Number", + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", "type": "string" }, - "surname": { - "title": "Surname", + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", "type": "string" }, - "tags": { + "urls": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/url" }, - "title": "Tags", + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", "type": "array" } }, - "title": "LDAP Person", + "title": "Email", "type": "object" }, - "location": { + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "city" + "name" ] }, { "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" + "uid" ] } ], "properties": { - "aerial_height": { - "title": "Aerial Height", + "name": { + "title": "Name", "type": "string" }, - "city": { - "title": "City", + "src_url": { + "title": "Source URL", "type": "string" }, - "continent": { - "title": "Continent", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", "type": "string" }, - "coordinates": { + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { "items": { - "type": "number" + "$ref": "#/$defs/http_header" }, - "title": "Coordinates", + "title": "HTTP Headers", "type": "array" }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", "type": "string" }, - "geohash": { - "title": "Geohash", - "type": "string" + "length": { + "title": "Request Length", + "type": "integer" }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", + "referrer": { + "title": "HTTP Referrer", "type": "string" }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "pressure_altitude": { - "title": "Pressure Altitude", + "user_agent": { + "title": "HTTP User-Agent", "type": "string" }, - "provider": { - "title": "Provider", + "version": { + "title": "HTTP Version", "type": "string" }, - "region": { - "title": "Region", - "type": "string" + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" } }, - "title": "Geo Location", + "title": "HTTP Request", "type": "object" }, - "logger": { + "cvss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "base_score": { + "title": "Base Score", + "type": "number" }, - "log_format": { - "title": "Log Format", + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", "type": "string" }, - "log_level": { - "title": "Log Level", - "type": "string" + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" }, - "log_name": { - "title": "Log Name", - "type": "string" + "overall_score": { + "title": "Overall Score", + "type": "number" }, - "log_provider": { - "title": "Log Provider", + "severity": { + "title": "Severity", "type": "string" }, - "log_version": { - "title": "Log Version", + "src_url": { + "title": "Source URL", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", + "vector_string": { + "title": "Vector String", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Logger", + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", "type": "object" }, - "long_string": { + "fingerprint": { "additionalProperties": false, "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "algorithm": { + "title": "Algorithm", + "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", "type": "integer" }, "value": { @@ -3815,111 +3867,69 @@ } }, "required": [ + "algorithm_id", "value" ], - "title": "Long String", + "title": "Fingerprint", "type": "object" }, - "malware": { + "process_entity": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "cmd_line" ] }, { "required": [ - "uid" + "cpid" ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" + { + "required": [ + "name" + ] }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" + { + "required": [ + "path" + ] }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" + { + "required": [ + "pid" + ] }, - "name": { - "title": "Name", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "provider": { - "title": "Provider", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", "type": "string" }, - "severity": { - "title": "Severity", + "path": { + "title": "Path", "type": "string" }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", + "pid": { + "title": "Process ID", "type": "integer" }, "uid": { @@ -3927,54 +3937,23 @@ "type": "string" } }, - "required": [ - "classification_ids" - ], - "title": "Malware", + "title": "Process Entity", "type": "object" }, - "malware_scan_info": { + "observable": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "end_time": { - "title": "End Time", - "type": "integer" + "event_uid": { + "title": "Event UID", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, "type": { "title": "Type", @@ -3990,277 +3969,230 @@ 5, 6, 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, 99 ], "title": "Type ID", "type": "integer" }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", + "type_uid": { + "title": "Type ID", "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" } }, "required": [ "type_id" ], - "title": "Malware Scan Info", + "title": "Observable", "type": "object" }, - "message_context": { + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { "additionalProperties": false, "anyOf": [ { "required": [ - "application" + "sub_technique" ] }, { "required": [ - "service" + "tactic" + ] + }, + { + "required": [ + "technique" ] } ], "properties": { - "ai_role": { - "title": "AI Role", - "type": "string" + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" }, - "ai_role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "AI Role ID", - "type": "integer" - }, - "application": { - "$ref": "#/$defs/application", - "title": "Application" - }, - "completion_tokens": { - "title": "Completion Tokens", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" }, - "prompt_tokens": { - "title": "Prompt Tokens", - "type": "integer" + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" }, - "total_tokens": { - "title": "Total Tokens", - "type": "integer" + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" }, - "uid": { - "title": "Unique ID", + "version": { + "title": "Version", "type": "string" } }, - "title": "Message Context", + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", "type": "object" }, - "metadata": { + "network_interface": { "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "log_name": { - "title": "Log Name", - "type": "string" + { + "required": [ + "ip" + ] }, - "log_provider": { - "title": "Log Provider", - "type": "string" + { + "required": [ + "mac" + ] }, - "log_source": { - "title": "Log Source", - "type": "string" + { + "required": [ + "name" + ] }, - "log_version": { - "title": "Log Version", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", + "ip": { + "title": "IP Address", "type": "string" }, - "original_time": { - "title": "Original Time", + "mac": { + "title": "MAC Address", "type": "string" }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", + "name": { + "title": "Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", + "namespace": { + "title": "Namespace", "type": "string" }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { + "open_ports": { "items": { - "$ref": "#/$defs/transformation_info" + "$ref": "#/$defs/port_info" }, - "title": "Transformation Info", + "title": "Open Ports", "type": "array" }, - "transmit_time": { - "title": "Transmission Time", + "subnet_prefix": { + "title": "Subnet Prefix Length", "type": "integer" }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "name", - "value" - ], - "title": "Metric", + "title": "Network Interface", "type": "object" }, - "mitigation": { + "user": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "account" + ] + }, { "required": [ "name" @@ -4273,203 +4205,132 @@ } ], "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "src_url": { - "title": "Source URL", + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "uid": { - "title": "Unique ID", + "display_name": { + "title": "Display Name", "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_endpoint": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" }, "domain": { "title": "Domain", "type": "string" }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", + "email_addr": { + "title": "Email Address", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "forward_addr": { + "title": "Forwarding Address", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "full_name": { + "title": "Full Name", "type": "string" }, - "intermediate_ips": { + "groups": { "items": { - "type": "string" + "$ref": "#/$defs/group" }, - "title": "Intermediate IP Addresses", + "title": "Groups", "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" }, - "isp": { - "title": "ISP Name", - "type": "string" + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" }, - "isp_org": { - "title": "ISP Org", + "name": { + "title": "Name", "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "mac_vendor": { - "title": "MAC Vendor", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" }, - "network_scope": { - "title": "Network Scope", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "network_scope_id": { + "risk_level_id": { "enum": [ 0, 1, 2, + 3, + 4, 99 ], - "title": "Network Scope ID", + "title": "Risk Level ID", "type": "integer" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "type": { + "title": "Type", + "type": "string" }, - "port": { - "title": "Port", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" + "uid": { + "title": "Unique ID", + "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "uid_alt": { + "title": "Alternate ID", "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "svc_name": { - "title": "Service Name", + "email_addr": { + "title": "Email Address", "type": "string" }, - "type": { - "title": "Type", + "factor_type": { + "title": "Factor Type", "type": "string" }, - "type_id": { + "factor_type_id": { "enum": [ 0, 1, @@ -4483,292 +4344,226 @@ 9, 10, 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "Factor Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" }, - "vpc_uid": { - "title": "VPC UID", + "phone_number": { + "title": "Phone Number", "type": "string" }, - "zone": { - "title": "Network Zone", + "provider": { + "title": "Provider", "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" } + }, + "required": [ + "factor_type_id" ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, "properties": { - "hostname": { - "title": "Hostname", + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", "type": "string" }, - "ip": { - "title": "IP Address", + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", "type": "string" }, - "mac": { - "title": "MAC Address", + "detection_pattern": { + "title": "Detection Pattern", "type": "string" }, - "name": { - "title": "Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "namespace": { - "title": "Namespace", + "category": { + "title": "Category", "type": "string" }, - "open_ports": { + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { "items": { - "$ref": "#/$defs/port_info" + "type": "string" }, - "title": "Open Ports", + "title": "Related Subdomains", "type": "array" }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, "type": { "title": "Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", + "uploaded_time": { + "title": "Uploaded Time", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "network_proxy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - { - "required": [ - "interface_name" - ] + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - { - "required": [ - "interface_uid" - ] + "comment": { + "title": "Analyst Comments", + "type": "string" }, - { - "required": [ - "ip" - ] + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - { - "required": [ - "name" - ] + "value": { + "title": "Indicator", + "type": "string" }, - { - "required": [ - "svc_name" - ] + "created_time": { + "title": "Created Time", + "type": "integer" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { + "intrusion_sets": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "Intrusion Sets", "type": "array" }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" }, - "domain": { - "title": "Domain", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "fingerprints": { + "attacks": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/attack" }, - "title": "Fingerprints", + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", "type": "array" }, - "hostname": { - "title": "Hostname", - "type": "string" + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "file": { + "$ref": "#/$defs/file", + "title": "Related File" }, - "instance_uid": { - "title": "Instance ID", - "type": "string" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "interface_name": { - "title": "Network Interface Name", + "name": { + "title": "Name", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" }, - "intermediate_ips": { + "kill_chain": { "items": { - "type": "string" + "$ref": "#/$defs/kill_chain_phase" }, - "title": "Intermediate IP Addresses", + "title": "Kill Chain", "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { + "detection_pattern_type_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", + "title": "Detection Pattern Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", + "detection_pattern_type": { + "title": "Detection Pattern", "type": "string" }, - "svc_name": { - "title": "Service Name", - "type": "string" + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" }, "type_id": { "enum": [ @@ -4787,42 +4582,91 @@ 12, 13, 14, - 15, 99 ], - "title": "Type ID", + "title": "Indicator Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "vlan_uid": { - "title": "VLAN", + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", "type": "string" }, - "vpc_uid": { - "title": "VPC UID", + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "zone": { - "title": "Network Zone", + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" } }, - "title": "Network Proxy Endpoint", + "required": [ + "type_id", + "value" + ], + "title": "OSINT", "type": "object" }, - "node": { + "san": { "additionalProperties": false, "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" @@ -4830,182 +4674,83 @@ "type": { "title": "Type", "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" } }, "required": [ - "uid" + "name", + "type" ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", + "title": "Subject Alternative Name", "type": "object" }, - "observable": { + "occurrence_details": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], "properties": { - "event_uid": { - "title": "Event UID", + "cell_name": { + "title": "Cell Name", "type": "string" }, - "name": { - "title": "Name", + "column_name": { + "title": "Column Name", "type": "string" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "column_number": { + "title": "Column Number", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", "type": "string" }, "page_number": { @@ -5028,7 +4773,7 @@ "title": "Occurrence Details", "type": "object" }, - "organization": { + "firewall_rule": { "additionalProperties": false, "anyOf": [ { @@ -5043,91 +4788,164 @@ } ], "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "ou_name": { - "title": "Org Unit Name", + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", "type": "string" }, - "ou_uid": { - "title": "Org Unit ID", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Organization", + "title": "Firewall Rule", "type": "object" }, - "os": { + "threat_actor": { "additionalProperties": false, "properties": { - "build": { - "title": "OS Build", + "name": { + "title": "Name", "type": "string" }, - "country": { - "title": "Country", + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", "type": "string" }, "cpe_name": { "title": "The product CPE identifier", "type": "string" }, - "cpu_bits": { - "title": "CPU Bits", + "epoch": { + "title": "Epoch", "type": "integer" }, - "edition": { - "title": "OS Edition", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "kernel_release": { - "title": "Kernel Release", + "license": { + "title": "Software License", "type": "string" }, - "lang": { - "title": "Language", + "license_url": { + "title": "Software License URL", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "sp_name": { - "title": "OS Service Pack", + "package_manager": { + "title": "Package Manager", "type": "string" }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" }, - "type": { - "title": "Type", + "purl": { + "title": "Package URL", "type": "string" }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 ], "title": "Type ID", "type": "integer" }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, "version": { "title": "Version", "type": "string" @@ -5135,367 +4953,328 @@ }, "required": [ "name", - "type_id" + "version" ], - "title": "Operating System (OS)", + "title": "Software Package", "type": "object" }, - "osint": { + "transformation_info": { "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "comment": { - "title": "Analyst Comments", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", "type": "string" }, - "confidence": { - "title": "Confidence", + "name": { + "title": "Name", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "created_time": { - "title": "Created Time", + "time": { + "title": "Event Time", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", + "uid": { + "title": "Unique ID", "type": "string" }, - "detection_pattern_type": { - "title": "Detection Pattern", + "url_string": { + "title": "URL String", "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", "type": "integer" }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "data": { + "title": "Data" }, - "external_uid": { - "title": "External ID", + "error": { + "title": "Error Code", "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" + "error_message": { + "title": "Error Message", + "type": "string" }, - "intrusion_sets": { + "flags": { "items": { "type": "string" }, - "title": "Intrusion Sets", + "title": "Flags", "type": "array" }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + { + "required": [ + "ip" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "name" + ] }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "ip": { + "title": "IP Address", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { "items": { - "$ref": "#/$defs/digital_signature" + "type": "string" }, - "title": "Related Digital Signatures", + "title": "Website Categorization", "type": "array" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { + "category_ids": { "items": { - "type": "string" + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" }, - "title": "Related Subdomains", + "title": "Website Categorization IDs", "type": "array" }, - "subnet": { - "title": "Related Subnet", + "domain": { + "title": "Domain", "type": "string" }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", + "hostname": { + "title": "Hostname", "type": "string" }, - "type": { - "title": "Type", + "path": { + "title": "Path", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", + "port": { + "title": "Port", "type": "integer" }, - "uid": { - "title": "Unique ID", + "query_string": { + "title": "HTTP Query String", "type": "string" }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", + "resource_type": { + "title": "Resource Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "scheme": { + "title": "Scheme", "type": "string" }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" + "subdomain": { + "title": "Subdomain", + "type": "string" }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" + "url_string": { + "title": "URL String", + "type": "string" } }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", + "title": "Uniform Resource Locator", "type": "object" }, - "package": { + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "name": { "title": "Name", "type": "string" }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", + "title": "Unique ID", "type": "string" }, "version": { @@ -5504,65 +5283,65 @@ } }, "required": [ - "name", "version" ], - "title": "Software Package", + "title": "Schema Extension", "type": "object" }, - "policy": { + "gpu_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", + "bus_type": { + "title": "Bus Type", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" }, - "is_applied": { - "title": "Applied", - "type": "boolean" + "cores": { + "title": "Cores", + "type": "integer" }, - "name": { - "title": "Name", + "model": { + "title": "Model", "type": "string" }, - "type": { - "title": "Type", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "uid": { - "title": "Unique ID", + "vram_mode": { + "title": "VRAM Mode", "type": "string" }, - "version": { - "title": "Version", - "type": "string" + "vram_mode_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "VRAM Mode ID", + "type": "integer" + }, + "vram_size": { + "title": "VRAM Size", + "type": "integer" } }, - "title": "Policy", + "title": "GPU Information", "type": "object" }, "port_info": { @@ -5587,164 +5366,104 @@ "title": "Port Information", "type": "object" }, - "process": { + "service": { "additionalProperties": false, "anyOf": [ { "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" + "name" ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { + { + "required": [ + "uid" + ] + } + ], + "properties": { + "labels": { "items": { "type": "string" }, - "title": "Loaded Modules", + "title": "Labels", "type": "array" }, "name": { "title": "Name", "type": "string" }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "path": { - "title": "Path", + "uid": { + "title": "Unique ID", "type": "string" }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", "type": "string" }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" + "data": { + "title": "Data" }, - "tid": { - "title": "Thread ID", - "type": "integer" + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" }, "uid": { "title": "Unique ID", "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, - "title": "Process", + "required": [ + "uid" + ], + "title": "Request Elements", "type": "object" }, - "process_entity": { + "sub_technique": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, { "required": [ "name" @@ -5752,12 +5471,33 @@ }, { "required": [ - "path" + "uid" ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "pid" + "name" ] }, { @@ -5767,39 +5507,65 @@ } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" + "image": { + "$ref": "#/$defs/image", + "title": "Image" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "network_driver": { + "title": "Network Driver", "type": "string" }, - "pid": { - "title": "Process ID", + "orchestrator": { + "title": "Orchestrator", + "type": "string" + }, + "pod_uuid": { + "title": "Pod UUID", + "type": "string" + }, + "runtime": { + "title": "Runtime", + "type": "string" + }, + "size": { + "title": "Size", "type": "integer" }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "Process Entity", + "title": "Container", "type": "object" }, - "product": { + "malware": { "additionalProperties": false, "anyOf": [ { @@ -5814,175 +5580,221 @@ } ], "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" + "classifications": { + "items": { + "type": "string" + }, + "title": "Classifications", + "type": "array" }, - "lang": { - "title": "Language", - "type": "string" + "cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" }, "name": { "title": "Name", "type": "string" }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, "path": { "title": "Path", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", + "provider": { + "title": "Provider", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "severity": { + "title": "Severity", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" } }, "required": [ - "uid" + "classification_ids" ], - "title": "Programmatic Credential", + "title": "Malware", "type": "object" }, - "remediation": { + "win_win_service": { "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" + "anyOf": [ + { + "required": [ + "cmd_line" + ] }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + { + "required": [ + "service_category_id" + ] }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + { + "required": [ + "service_dependencies" + ] }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ { "required": [ - "hostname" + "service_error_control_id" ] }, { "required": [ - "ip" + "service_start_name" ] }, { "required": [ - "name" + "service_start_type_id" ] }, { "required": [ - "uid" + "service_type_id" ] } ], "properties": { - "hostname": { - "title": "Hostname", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "ip": { - "title": "IP Address", + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "service_category": { + "title": "Service Category", + "type": "string" }, - "uid": { - "title": "Unique ID", + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" }, - "provider": { - "title": "Provider", + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", "type": "string" }, - "score": { - "title": "Reputation Score", + "service_start_type": { + "title": "Service Start Type", "type": "string" }, - "score_id": { + "service_start_type_id": { "enum": [ 0, 1, @@ -5990,58 +5802,127 @@ 3, 4, 5, - 6, - 7, - 8, - 9, - 10, 99 ], - "title": "Reputation Score ID", + "title": "Service Start Type ID", + "type": "integer" + }, + "service_type": { + "title": "Service Type", + "type": "string" + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "base_score", - "score_id" + "name" ], - "title": "Reputation", + "title": "Windows Service", "type": "object" }, - "request": { + "group": { "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" }, - "data": { - "title": "Data" + "domain": { + "title": "Domain", + "type": "string" }, - "flags": { + "name": { + "title": "Name", + "type": "string" + }, + "privileges": { "items": { "type": "string" }, - "title": "Flags", + "title": "Privileges", "type": "array" }, + "type": { + "title": "Group Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "required": [ - "uid" - ], - "title": "Request Elements", + "title": "Group", "type": "object" }, - "resource_details": { + "device": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" @@ -6054,72 +5935,196 @@ } ], "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" + "region": { + "title": "Region", + "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "interface_name": { + "title": "Network Interface Name", + "type": "string" }, - "criticality": { - "title": "Criticality", + "uid": { + "title": "Unique ID", "type": "string" }, - "data": { - "title": "Data" + "interface_uid": { + "title": "Network Interface ID", + "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "modified_time": { + "title": "Modified Time", + "type": "integer" }, - "hostname": { - "title": "Hostname", + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", "type": "string" }, - "ip": { - "title": "IP Address", + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", + "type": "string" + }, + "type": { + "title": "Type", "type": "string" }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, "is_backed_up": { "title": "Back Ups Configured", "type": "boolean" }, - "labels": { + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", + "type": "string" + }, + "imei_list": { "items": { "type": "string" }, - "title": "Labels", + "title": "IMEI List", "type": "array" }, - "modified_time": { - "title": "Modified Time", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", "type": "integer" }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, "name": { "title": "Name", "type": "string" }, - "namespace": { - "title": "Namespace", + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, "owner": { "$ref": "#/$defs/user", "title": "Owner" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" + "boot_time": { + "title": "Boot Time", + "type": "integer" }, - "role": { - "title": "Role", - "type": "string" + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" }, - "role_id": { + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "risk_level_id": { "enum": [ 0, 1, @@ -6128,136 +6133,184 @@ 4, 99 ], - "title": "Role ID", + "title": "Risk Level ID", "type": "integer" }, - "tags": { + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/network_interface" }, - "title": "Tags", + "title": "Network Interfaces", "type": "array" }, - "type": { - "title": "Type", + "autoscale_uid": { + "title": "Autoscale UID", "type": "string" }, - "uid": { - "title": "Unique ID", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "subnet": { + "title": "Subnet", "type": "string" }, - "version": { - "title": "Version", + "eid": { + "title": "EID", "type": "string" - } - }, - "title": "Resource Details", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" }, - "containers": { + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { "items": { - "$ref": "#/$defs/container" + "$ref": "#/$defs/agent" }, - "title": "Containers", + "title": "Agent List", "type": "array" }, - "data": { - "title": "Data" + "ip": { + "title": "IP Address", + "type": "string" }, - "error": { - "title": "Error Code", + "hostname": { + "title": "Hostname", "type": "string" }, - "error_message": { - "title": "Error Message", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" }, - "message": { - "title": "Message", + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "title": "Response Elements", + "required": [ + "type_id" + ], + "title": "Device", "type": "object" }, - "rule": { + "campaign": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" - }, - "type": { - "title": "Type", + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", "type": "string" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "CWE ID", "type": "string" } }, - "title": "Rule", + "required": [ + "uid" + ], + "title": "CWE", "type": "object" }, - "san": { + "digital_signature": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "type": { - "title": "Type", + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", + "type": "integer" + }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "developer_uid": { + "title": "Developer UID", + "type": "string" + }, + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" + }, + "state": { + "title": "State", "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" } }, "required": [ - "name", - "type" + "algorithm_id" ], - "title": "Subject Alternative Name", + "title": "Digital Signature", "type": "object" }, "sbom": { @@ -6313,146 +6366,91 @@ "title": "Software Bill of Materials", "type": "object" }, - "scim": { + "malware_scan_info": { "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, - "modified_time": { - "title": "Modified Time", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", "type": "integer" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" + "num_files": { + "title": "Scanned Files", + "type": "integer" }, - "rate_limit": { - "title": "Rate Limit", + "num_infected": { + "title": "Number of Infected Entities", "type": "integer" }, - "scim_group_schema": { - "title": "SCIM Group Schema" + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" }, - "scim_user_schema": { - "title": "SCIM User Schema" + "size": { + "title": "Size", + "type": "integer" }, - "state": { - "title": "State", + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "state_id": { + "type_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, + 7, 99 ], - "title": "State ID", + "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", + "title": "Scan UID", "type": "string" }, - "version": { - "title": "SCIM Version", - "type": "string" + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" } }, - "title": "SCIM", + "required": [ + "type_id" + ], + "title": "Malware Scan Info", "type": "object" }, - "script": { + "kill_chain_phase": { "additionalProperties": false, "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", + "phase": { + "title": "Kill Chain Phase", "type": "string" }, - "type_id": { + "phase_id": { "enum": [ 0, 1, @@ -6464,22 +6462,17 @@ 7, 99 ], - "title": "Type ID", + "title": "Kill Chain Phase ID", "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" } }, "required": [ - "script_content", - "type_id" + "phase_id" ], - "title": "Script", + "title": "Kill Chain Phase", "type": "object" }, - "service": { + "organization": { "additionalProperties": false, "anyOf": [ { @@ -6494,218 +6487,273 @@ } ], "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, "name": { "title": "Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "ou_name": { + "title": "Org Unit Name", + "type": "string" }, - "uid": { - "title": "Unique ID", + "ou_uid": { + "title": "Org Unit ID", "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Service", + "title": "Organization", "type": "object" }, - "session": { + "encryption_details": { "additionalProperties": false, "properties": { - "count": { - "title": "Count", + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", "type": "integer" }, - "created_time": { - "title": "Created Time", + "key_length": { + "title": "Encryption Key Length", "type": "integer" }, - "credential_uid": { - "title": "User Credential ID", + "key_uid": { + "title": "Key UID", "type": "string" }, - "expiration_reason": { - "title": "Expiration Reason", + "type": { + "title": "Encryption Type", "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" + "event_uid": { + "title": "Event UID", + "type": "string" }, - "is_remote": { - "title": "Remote", + "is_truncated": { + "title": "Is Truncated", "type": "boolean" }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" + "log_format": { + "title": "Log Format", + "type": "string" }, - "issuer": { - "title": "Issuer Details", + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", "type": "string" }, - "terminal": { - "title": "Terminal", + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Logger", + "type": "object" + }, + "feature": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", + "version": { + "title": "Version", "type": "string" } }, - "title": "Session", + "title": "Feature", "type": "object" }, - "software_component": { + "timespan": { "additionalProperties": false, - "properties": { - "author": { - "title": "Author", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "anyOf": [ + { + "required": [ + "duration" + ] }, - "license": { - "title": "Software License", - "type": "string" + { + "required": [ + "duration_days" + ] }, - "name": { - "title": "Name", - "type": "string" + { + "required": [ + "duration_hours" + ] }, - "purl": { - "title": "Package URL", - "type": "string" + { + "required": [ + "duration_mins" + ] }, - "related_component": { - "title": "Related Component", - "type": "string" + { + "required": [ + "duration_months" + ] }, - "relationship": { - "title": "Relationship", - "type": "string" + { + "required": [ + "duration_secs" + ] }, - "relationship_id": { - "enum": [ - 0, - 1, - 99 - ], - "title": "Relationship ID", - "type": "integer" + { + "required": [ + "duration_weeks" + ] }, - "type": { - "title": "Type", - "type": "string" + { + "required": [ + "duration_years" + ] }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", - "type": "integer" + { + "required": [ + "end_time" + ] }, - "version": { - "title": "Version", - "type": "string" + { + "required": [ + "start_time" + ] } - }, - "required": [ - "name", - "version" ], - "title": "Software Component", - "type": "object" - }, - "span": { - "additionalProperties": false, "properties": { "duration": { "title": "Duration Milliseconds", "type": "integer" }, - "end_time": { - "title": "End Time", + "duration_days": { + "title": "Duration Days", "type": "integer" }, - "message": { - "title": "Message", - "type": "string" + "duration_hours": { + "title": "Duration Hours", + "type": "integer" }, - "operation": { - "title": "Operation", - "type": "string" + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" + "duration_months": { + "title": "Duration Months", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" }, "start_time": { "title": "Start Time", "type": "integer" }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "type": { + "title": "Time Span Type", "type": "string" }, - "auth_protocol_id": { + "type_id": { "enum": [ 0, 1, @@ -6717,74 +6765,16 @@ 7, 8, 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", + "title": "Time Span Type ID", "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" } }, - "title": "SSO", + "title": "Time Span", "type": "object" }, - "sub_technique": { + "rule": { "additionalProperties": false, "anyOf": [ { @@ -6799,54 +6789,102 @@ } ], "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "MITRE Sub-technique", + "title": "Rule", "type": "object" }, - "tactic": { + "software_component": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "purl": { + "title": "Package URL", "type": "string" }, - "uid": { - "title": "Unique ID", + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "MITRE Tactic", + "required": [ + "name", + "version" + ], + "title": "Software Component", "type": "object" }, - "technique": { + "agent": { "additionalProperties": false, "anyOf": [ { @@ -6862,258 +6900,361 @@ ], "properties": { "name": { - "title": "Name", + "title": "Agent Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" + }, + "type": { + "title": "Agent Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, "uid": { - "title": "Unique ID", + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", "type": "string" } }, - "title": "MITRE Technique", + "title": "Agent", "type": "object" }, - "threat_actor": { + "whois": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", - "type": "string" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "type": { - "title": "Threat Actor Type", + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", "type": "string" }, - "type_id": { + "dnssec_status_id": { "enum": [ 0, 1, 2, - 3, - 4, 99 ], - "title": "Threat Actor Type ID", + "title": "DNSSEC Status ID", "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] }, - { - "required": [ - "duration_days" - ] + "domain": { + "title": "Domain", + "type": "string" }, - { - "required": [ - "duration_hours" - ] + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" }, - { - "required": [ - "duration_mins" - ] + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" }, - { - "required": [ - "duration_months" - ] + "isp": { + "title": "ISP Name", + "type": "string" }, - { - "required": [ - "duration_secs" - ] + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "last_seen_time": { + "title": "Last Updated At", + "type": "integer" + }, + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", + "type": "string" + }, + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" }, + "subnet": { + "title": "Subnet Block", + "type": "string" + } + }, + "title": "WHOIS", + "type": "object" + }, + "key_value_object": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "duration_weeks" + "value" ] }, { "required": [ - "duration_years" + "values" ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" }, - { - "required": [ - "end_time" - ] + "value": { + "title": "Value", + "type": "string" }, - { - "required": [ - "start_time" - ] + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" } + }, + "required": [ + "name" ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "log_format": { + "title": "Log Source Format", + "type": "string" }, - "duration_days": { - "title": "Duration Days", - "type": "integer" + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" + "uid": { + "title": "Event UID", + "type": "string" }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" + "original_event_uid": { + "title": "Original Event ID", + "type": "string" }, - "duration_months": { - "title": "Duration Months", - "type": "integer" + "log_name": { + "title": "Log Name", + "type": "string" }, - "duration_secs": { - "title": "Duration Seconds", + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" + "log_level": { + "title": "Log Level", + "type": "string" }, - "duration_years": { - "title": "Duration Years", - "type": "integer" + "type": { + "title": "Type", + "type": "string" }, - "end_time": { - "title": "End Time", - "type": "integer" + "log_version": { + "title": "Log Version", + "type": "string" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" }, - "type": { - "title": "Time Span Type", + "source": { + "title": "Source", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "expiration_time": { - "title": "Expiration Time", + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", "type": "integer" }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" + "log_source": { + "title": "Log Source", + "type": "string" }, - "modified_time": { - "title": "Modified Time", + "logged_time": { + "title": "Logged Time", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" }, - "tenant_uid": { - "title": "Tenant UID", + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", "type": "string" }, - "type": { - "title": "Type", + "event_code": { + "title": "Event Code", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "uid": { - "title": "Unique ID", + "tenant_uid": { + "title": "Tenant UID", "type": "string" }, - "zone": { - "title": "Network Zone", + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" }, - "end_time": { - "title": "End Time", - "type": "integer" + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" }, - "flags": { + "labels": { "items": { "type": "string" }, - "title": "Flags", + "title": "Labels", "type": "array" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "sequence": { + "title": "Sequence Number", + "type": "integer" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", + "type": "string" }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" + "name": { + "title": "Name", + "type": "string" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "type": { + "title": "Type", + "type": "string" }, "uid": { "title": "Unique ID", @@ -7123,10 +7264,10 @@ "required": [ "uid" ], - "title": "Trace", + "title": "Node", "type": "object" }, - "transformation_info": { + "product": { "additionalProperties": false, "anyOf": [ { @@ -7141,6 +7282,14 @@ } ], "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, "lang": { "title": "Language", "type": "string" @@ -7149,13 +7298,9 @@ "title": "Name", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" + "path": { + "title": "Path", + "type": "string" }, "uid": { "title": "Unique ID", @@ -7164,175 +7309,148 @@ "url_string": { "title": "URL String", "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Transformation Info", + "title": "Product", "type": "object" }, - "url": { + "advisory": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" + "bulletin": { + "title": "Patch Bulletin", + "type": "string" }, - "domain": { - "title": "Domain", + "classification": { + "title": "Classification", "type": "string" }, - "hostname": { - "title": "Hostname", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", "type": "string" }, - "path": { - "title": "Path", + "install_state": { + "title": "Install State", "type": "string" }, - "port": { - "title": "Port", + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", "type": "integer" }, - "query_string": { - "title": "HTTP Query String", - "type": "string" + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" }, - "resource_type": { - "title": "Resource Type", - "type": "string" + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", + "type": "integer" }, - "scheme": { - "title": "Scheme", + "src_url": { + "title": "Source URL", "type": "string" }, - "subdomain": { - "title": "Subdomain", + "title": { + "title": "Title", "type": "string" }, - "url_string": { - "title": "URL String", + "uid": { + "title": "Advisory ID", "type": "string" } }, - "title": "Uniform Resource Locator", + "required": [ + "uid" + ], + "title": "Advisory", "type": "object" }, - "user": { + "network_endpoint": { "additionalProperties": false, "anyOf": [ { "required": [ - "account" + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" ] }, { @@ -7340,6 +7458,11 @@ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -7347,88 +7470,125 @@ } ], "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "display_name": { - "title": "Display Name", - "type": "string" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, "domain": { "title": "Domain", "type": "string" }, - "email_addr": { - "title": "Email Address", + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "hostname": { + "title": "Hostname", "type": "string" }, - "forward_addr": { - "title": "Forwarding Address", + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "full_name": { - "title": "Full Name", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "groups": { + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { "items": { - "$ref": "#/$defs/group" + "type": "string" }, - "title": "Groups", + "title": "Intermediate IP Addresses", "type": "array" }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" + "ip": { + "title": "IP Address", + "type": "string" }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" + "isp": { + "title": "ISP Name", + "type": "string" }, - "name": { - "title": "Name", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "phone_number": { - "title": "Telephone Number", + "mac": { + "title": "MAC Address", "type": "string" }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" + "mac_vendor": { + "title": "MAC Vendor", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "name": { + "title": "Name", "type": "string" }, - "risk_level_id": { + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { "enum": [ 0, 1, 2, - 3, - 4, 99 ], - "title": "Risk Level ID", + "title": "Network Scope ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "port": { + "title": "Port", "type": "integer" }, + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, "type": { "title": "Type", "type": "string" @@ -7440,6 +7600,17 @@ 2, 3, 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, 99 ], "title": "Type ID", @@ -7449,161 +7620,94 @@ "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "vlan_uid": { + "title": "VLAN", + "type": "string" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", "type": "string" } }, - "title": "User", + "title": "Network Endpoint", "type": "object" }, - "vulnerability": { + "d3f_tactic": { "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, + "anyOf": [ { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, "required": [ - "cve" + "name" ] }, { - "not": { - "required": [ - "advisory", - "cve" - ] - }, "required": [ - "cwe" + "uid" ] } ], "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" + "name": { + "title": "Name", + "type": "string" }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" }, - "affected_packages": { + "cvss": { "items": { - "$ref": "#/$defs/affected_package" + "$ref": "#/$defs/cvss" }, - "title": "Affected Software Packages", + "title": "CVSS Score", "type": "array" }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, "cwe": { "$ref": "#/$defs/cwe", "title": "CWE" }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", + "cwe_uid": { + "title": "CWE UID", "type": "string" }, - "exploit_type": { - "title": "Exploit Type", + "cwe_url": { + "title": "CWE URL", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", + "desc": { + "title": "Description", "type": "string" }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" }, - "last_seen_time": { - "title": "Last Seen", + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, "references": { "items": { @@ -7612,284 +7716,180 @@ "title": "References", "type": "array" }, - "related_vulnerabilities": { + "related_cwes": { "items": { - "type": "string" + "$ref": "#/$defs/cwe" }, - "title": "Related Vulnerability IDs", + "title": "Related CWEs", "type": "array" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, "title": { "title": "Title", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "type": { + "title": "Vulnerability Type", + "type": "string" + }, + "uid": { + "title": "CVE ID", "type": "string" } }, - "title": "Vulnerability Details", + "required": [ + "uid" + ], + "title": "CVE", "type": "object" }, - "whois": { + "domain_contact": { "additionalProperties": false, "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, "email_addr": { - "title": "Registrar Abuse Email Address", + "title": "Contact Email", "type": "string" }, - "isp": { - "title": "ISP Name", - "type": "string" + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" }, - "isp_org": { - "title": "ISP Org", + "name": { + "title": "Name", "type": "string" }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", + "title": "Phone Number", "type": "string" }, - "status": { - "title": "Domain Status", + "type": { + "title": "Domain Contact Type", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" }, - "subnet": { - "title": "Subnet Block", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "WHOIS", + "required": [ + "type_id" + ], + "title": "Domain Contact", "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, + }, + "policy": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "service_start_name" + "name" ] }, { "required": [ - "service_start_type_id" + "type" ] }, { "required": [ - "service_type_id" + "uid" ] } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" + "data": { + "title": "Data" }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" + "desc": { + "title": "Description", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" + "is_applied": { + "title": "Applied", + "type": "boolean" }, "name": { "title": "Name", "type": "string" }, - "service_category": { - "title": "Service Category", + "type": { + "title": "Type", "type": "string" }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", + "uid": { + "title": "Unique ID", "type": "string" }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" + "end_time": { + "title": "End Time", + "type": "integer" }, - "service_start_name": { - "title": "Service Start Name", + "message": { + "title": "Message", "type": "string" }, - "service_start_type": { - "title": "Service Start Type", + "operation": { + "title": "Operation", "type": "string" }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "status_code": { + "title": "Status Code", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "name" + "end_time", + "start_time", + "uid" ], - "title": "Windows Service", + "title": "Span", "type": "object" } }, @@ -7897,62 +7897,20 @@ "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" - }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Activity ID", - "type": "integer" + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" }, - "activity_name": { - "title": "Activity", + "message": { + "title": "Message", "type": "string" }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "api": { - "$ref": "#/$defs/api", - "title": "API Details" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" }, - "category_name": { - "title": "Category", + "disposition": { + "title": "Disposition", "type": "string" }, "category_uid": { @@ -7960,44 +7918,36 @@ "title": "Category ID", "type": "integer" }, - "class_name": { - "title": "Class", + "action": { + "title": "Action", "type": "string" }, - "class_uid": { - "const": 6003, - "title": "Class ID", - "type": "integer" - }, "confidence": { "title": "Confidence", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", + "api": { + "$ref": "#/$defs/api", + "title": "API Details" + }, + "risk_details": { + "title": "Risk Details", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, + "status_detail": { + "title": "Status Detail", + "type": "string" + }, "confidence_score": { "title": "Confidence Score", "type": "integer" }, - "count": { - "title": "Count", - "type": "integer" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "disposition": { - "title": "Disposition", + "status_code": { + "title": "Status Code", "type": "string" }, "disposition_id": { @@ -8035,60 +7985,74 @@ "title": "Disposition ID", "type": "integer" }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" + "type_name": { + "title": "Type Name", + "type": "string" }, - "duration": { - "title": "Duration Milliseconds", + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", "type": "integer" }, - "end_time": { - "title": "End Time", + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", "type": "integer" }, - "enrichments": { + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "attacks": { "items": { - "$ref": "#/$defs/enrichment" + "$ref": "#/$defs/attack" }, - "title": "Enrichments", + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", "type": "array" }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "http_request": { - "$ref": "#/$defs/http_request", - "title": "HTTP Request" + "status": { + "title": "Status", + "type": "string" }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", + "type": "integer" }, - "is_alert": { - "title": "Alert", - "type": "boolean" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "malware": { + "resources": { "items": { - "$ref": "#/$defs/malware" + "$ref": "#/$defs/resource_details" }, - "title": "Malware", + "title": "Resources Array", "type": "array" }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, "observables": { "items": { "$ref": "#/$defs/observable" @@ -8096,38 +8060,29 @@ "title": "Observables", "type": "array" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" + "enrichments": { + "items": { + "$ref": "#/$defs/enrichment" + }, + "title": "Enrichments", + "type": "array" }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" }, - "resources": { + "authorizations": { "items": { - "$ref": "#/$defs/resource_details" + "$ref": "#/$defs/authorization" }, - "title": "Resources Array", + "title": "Authorization Information", "type": "array" }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" }, - "risk_level_id": { + "action_id": { "enum": [ 0, 1, @@ -8136,84 +8091,129 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "Action ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", "type": "integer" }, - "severity": { - "title": "Severity", + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" + }, + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" + }, + "activity_name": { + "title": "Activity", "type": "string" }, - "severity_id": { + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "class_name": { + "title": "Class", + "type": "string" + }, + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" + }, + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Severity ID", + "title": "Risk Level ID", "type": "integer" }, - "src_endpoint": { + "raw_data_size": { + "title": "Raw Data Size", + "type": "integer" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "dst_endpoint": { "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" + "title": "Destination Endpoint" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "is_alert": { + "title": "Alert", + "type": "boolean" }, - "status": { - "title": "Status", - "type": "string" + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "status_code": { - "title": "Status Code", + "severity": { + "title": "Severity", "type": "string" }, - "status_detail": { - "title": "Status Detail", + "category_name": { + "title": "Category", "type": "string" }, - "status_id": { + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, + "severity_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Status ID", + "title": "Severity ID", "type": "integer" }, - "time": { - "title": "Event Time", + "count": { + "title": "Count", "type": "integer" }, - "timezone_offset": { - "title": "Timezone Offset", + "end_time": { + "title": "End Time", "type": "integer" }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, "type_uid": { "title": "Type ID", "type": "integer" }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" } }, "required": [ diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json index af955c32f7..d1315dd7c0 100644 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/api_activity@host+trace.json @@ -1,11 +1,11 @@ { "$defs": { - "account": { + "kb_article": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "src_url" ] }, { @@ -14,152 +14,6 @@ ] } ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, "properties": { "avg_timespan": { "$ref": "#/$defs/timespan", @@ -177,10 +31,6 @@ "title": "Created Time", "type": "integer" }, - "desc": { - "title": "Description", - "type": "string" - }, "install_state": { "title": "Install State", "type": "string" @@ -200,10 +50,6 @@ "title": "The patch is superseded.", "type": "boolean" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "os": { "$ref": "#/$defs/os", "title": "OS" @@ -212,26 +58,9 @@ "$ref": "#/$defs/product", "title": "Product" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, "size": { "title": "Size", @@ -246,247 +75,238 @@ "type": "string" }, "uid": { - "title": "Advisory ID", + "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Advisory", + "title": "KB Article", "type": "object" }, - "affected_code": { + "long_string": { "additionalProperties": false, "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "start_column": { - "title": "Start Column", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "file" + "value" ], - "title": "Affected Code", + "title": "Long String", "type": "object" }, - "affected_package": { + "enrichment": { "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpe_name": { - "title": "The product CPE identifier", + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "fixed_in_version": { - "title": "Fixed In Version", + "provider": { + "title": "Provider", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "license": { - "title": "Software License", + "short_desc": { + "title": "Short Description", "type": "string" }, - "license_url": { - "title": "Software License URL", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "type": { + "title": "Type", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", "type": "string" }, - "path": { - "title": "Path", + "display_name": { + "title": "Display Name", "type": "string" }, - "purl": { - "title": "Package URL", + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", "type": "string" }, - "release": { - "title": "Software Release Details", + "given_name": { + "title": "Given Name", "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "hire_time": { + "title": "Hire Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "job_title": { + "title": "Job Title", "type": "string" }, - "type": { - "title": "Type", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", "type": "integer" }, - "uid": { - "title": "Package UID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "version": { - "title": "Version", + "surname": { + "title": "Surname", "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" } }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", + "title": "LDAP Person", "type": "object" }, - "agent": { + "email_auth": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Agent Name", + "dkim": { + "title": "DKIM Status", "type": "string" }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", + "dkim_domain": { + "title": "DKIM Domain", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "dkim_signature": { + "title": "DKIM Signature", + "type": "string" }, - "uid": { - "title": "Agent ID", + "dmarc": { + "title": "DMARC Status", "type": "string" }, - "uid_alt": { - "title": "Alternate Agent ID", + "dmarc_override": { + "title": "DMARC Override", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "dmarc_policy": { + "title": "DMARC Policy", "type": "string" }, - "version": { - "title": "Agent Version", + "spf": { + "title": "SPF Status", "type": "string" } }, - "title": "Agent", + "title": "Email Authentication", "type": "object" }, - "ai_model": { + "epss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "ai_provider": { - "title": "AI Provider", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "percentile": { + "title": "EPSS Percentile", + "type": "number" }, - "uid": { - "title": "Unique ID", + "score": { + "title": "EPPS Score", "type": "string" }, "version": { @@ -495,54 +315,35 @@ } }, "required": [ - "ai_provider" + "score" ], - "title": "AI Model", + "title": "EPSS", "type": "object" }, - "analytic": { + "device_hw_info": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", + "bios_manufacturer": { + "title": "BIOS Manufacturer", "type": "string" }, - "desc": { - "title": "Description", + "bios_ver": { + "title": "BIOS Version", "type": "string" }, - "name": { - "title": "Name", + "chassis": { + "title": "Chassis", "type": "string" }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", + "cpu_architecture": { + "title": "CPU Architecture", "type": "string" }, - "state_id": { + "cpu_architecture_id": { "enum": [ 0, 1, @@ -550,93 +351,111 @@ 3, 99 ], - "title": "State ID", + "title": "CPU Architecture ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", + "cpu_cores": { + "title": "CPU Cores", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "cpu_count": { + "title": "CPU Count", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" }, - "operation": { - "title": "Operation", + "cpu_type": { + "title": "Processor Type", "type": "string" }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" + "gpu_count": { + "title": "GPU Count", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" }, - "version": { - "title": "Version", + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "required": [ - "operation" - ], - "title": "API", + "title": "Device Hardware Info", "type": "object" }, - "application": { + "network_proxy": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -644,166 +463,130 @@ } ], "properties": { - "criticality": { - "title": "Business Criticality", - "type": "string" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "data": { - "title": "Data" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "desc": { - "title": "Application Description", + "domain": { + "title": "Domain", "type": "string" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" }, "hostname": { "title": "Hostname", "type": "string" }, - "labels": { + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "intermediate_ips": { "items": { "type": "string" }, - "title": "Labels", + "title": "Intermediate IP Addresses", "type": "array" }, - "name": { - "title": "Application Name", + "ip": { + "title": "IP Address", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Application Relationship" + "isp": { + "title": "ISP Name", + "type": "string" }, - "risk_level": { - "title": "Risk Level", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "sbom": { - "$ref": "#/$defs/sbom", - "title": "Related SBOM" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Application Type", + "mac": { + "title": "MAC Address", "type": "string" }, - "uid": { - "title": "Application ID", + "mac_vendor": { + "title": "MAC Vendor", "type": "string" }, - "uid_alt": { - "title": "Application Alternative ID", + "name": { + "title": "Name", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Application Version", + "network_scope": { + "title": "Network Scope", "type": "string" - } - }, - "title": "Application", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] }, - { - "required": [ - "tactic" - ] + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" + "port": { + "title": "Port", + "type": "integer" }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" }, - "version": { - "title": "Version", + "subnet_uid": { + "title": "Subnet UID", "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" }, - "email_addr": { - "title": "Email Address", + "svc_name": { + "title": "Service Name", "type": "string" }, - "factor_type": { - "title": "Factor Type", + "type": { + "title": "Type", "type": "string" }, - "factor_type_id": { + "type_id": { "enum": [ 0, 1, @@ -817,237 +600,189 @@ 9, 10, 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Factor Type ID", + "title": "Type ID", "type": "integer" }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", + "uid": { + "title": "Unique ID", "type": "string" }, - "provider": { - "title": "Provider", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Authorization Result", + "title": "Network Proxy Endpoint", "type": "object" }, - "autonomous_system": { + "data_classification": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "category_id" ] }, { "required": [ - "number" + "confidentiality_id" ] } ], "properties": { - "name": { - "title": "Name", + "category": { + "title": "Category", "type": "string" }, - "number": { - "title": "Number", + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", + }, + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" + }, + "confidentiality": { + "title": "Confidentiality", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" }, - "expiration_time": { - "title": "Expiration Time", + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", "type": "integer" }, - "fingerprints": { + "discovery_details": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/discovery_details" }, - "title": "Fingerprints", + "title": "Discovery Details", "type": "array" }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" + "size": { + "title": "Size", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", + "status": { + "title": "Status", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "status_details": { + "items": { + "type": "string" + }, + "title": "Status Details", + "type": "array" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "total": { + "title": "Total", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" } }, - "required": [ - "type" - ], - "title": "Classifier Details", + "title": "Data Classification", "type": "object" }, - "cloud": { + "http_response": { "additionalProperties": false, "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" + "body_length": { + "title": "Response Body Length", + "type": "integer" }, - "cloud_partition": { - "title": "Cloud Partition", + "code": { + "title": "Response Code", + "type": "integer" + }, + "content_type": { + "title": "HTTP Content Type", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "project_uid": { - "title": "Project ID", - "type": "string" + "latency": { + "title": "Latency", + "type": "integer" }, - "provider": { - "title": "Cloud Provider", - "type": "string" + "length": { + "title": "Response Length", + "type": "integer" }, - "region": { - "title": "Region", + "message": { + "title": "Message", "type": "string" }, - "zone": { - "title": "Cloud Availability Zone", + "status": { + "title": "Status", "type": "string" } }, "required": [ - "provider" + "code" ], - "title": "Cloud", + "title": "HTTP Response", "type": "object" }, - "container": { + "resource_details": { "additionalProperties": false, "anyOf": [ { @@ -1062,13 +797,39 @@ } ], "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "criticality": { + "title": "Criticality", + "type": "string" + }, + "data": { + "title": "Data" + }, + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", + "type": "string" + }, + "ip": { + "title": "IP Address", + "type": "string" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" }, "labels": { "items": { @@ -1077,34 +838,42 @@ "title": "Labels", "type": "array" }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "network_driver": { - "title": "Network Driver", + "namespace": { + "title": "Namespace", "type": "string" }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Resource Relationship" }, - "runtime": { - "title": "Runtime", + "role": { + "title": "Role", "type": "string" }, - "size": { - "title": "Size", + "role_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Role ID", "type": "integer" }, - "tag": { - "title": "Image Tag", - "type": "string" - }, "tags": { "items": { "$ref": "#/$defs/key_value_object" @@ -1112,167 +881,262 @@ "title": "Tags", "type": "array" }, + "type": { + "title": "Type", + "type": "string" + }, "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Container", + "title": "Resource Details", "type": "object" }, - "cve": { + "display": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "color_depth": { + "title": "Color Depth", "type": "integer" }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" + "physical_height": { + "title": "Physical Height", + "type": "integer" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" + "physical_width": { + "title": "Physical Width", + "type": "integer" }, - "cwe_url": { - "title": "CWE URL", + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "desc": { - "title": "Description", + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", "type": "string" }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "name": { + "title": "Name", + "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "protocol_name": { + "title": "Supported Protocol", + "type": "string" }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "rate_limit": { + "title": "Rate Limit", + "type": "integer" }, - "title": { - "title": "Title", + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + }, + "version": { + "title": "SCIM Version", "type": "string" + } + }, + "title": "SCIM", + "type": "object" + }, + "programmatic_credential": { + "additionalProperties": false, + "properties": { + "last_used_time": { + "title": "Last Used Time", + "type": "integer" }, "type": { - "title": "Vulnerability Type", + "title": "Type", "type": "string" }, "uid": { - "title": "CVE ID", + "title": "Unique ID", "type": "string" } }, "required": [ "uid" ], - "title": "CVE", + "title": "Programmatic Credential", "type": "object" }, - "cvss": { + "os": { "additionalProperties": false, "properties": { - "base_score": { - "title": "Base Score", - "type": "number" + "build": { + "title": "OS Build", + "type": "string" }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", + "country": { + "title": "Country", "type": "string" }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" }, - "overall_score": { - "title": "Overall Score", - "type": "number" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "severity": { - "title": "Severity", + "edition": { + "title": "OS Edition", "type": "string" }, - "src_url": { - "title": "Source URL", + "kernel_release": { + "title": "Kernel Release", "type": "string" }, - "vector_string": { - "title": "Vector String", + "lang": { + "title": "Language", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "name": { + "title": "Name", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", + "sp_name": { + "title": "OS Service Pack", "type": "string" }, - "src_url": { - "title": "Source URL", + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "uid": { - "title": "CWE ID", + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, "required": [ - "uid" + "name", + "type_id" ], - "title": "CWE", + "title": "Operating System (OS)", "type": "object" }, - "d3f_tactic": { + "tactic": { "additionalProperties": false, "anyOf": [ { @@ -1300,91 +1164,101 @@ "type": "string" } }, - "title": "MITRE D3FEND\u2122 Tactic", + "title": "MITRE Tactic", "type": "object" }, - "d3f_technique": { + "dns_answer": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Name", + "class": { + "title": "Resource Record Class", "type": "string" }, - "src_url": { - "title": "Source URL", + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", "type": "string" }, - "uid": { - "title": "Unique ID", + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", "type": "string" } }, - "title": "MITRE D3FEND\u2122 Technique", + "required": [ + "rdata" + ], + "title": "DNS Answer", "type": "object" }, - "d3fend": { + "discovery_details": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" + "count": { + "title": "Count", + "type": "integer" }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" }, - "version": { - "title": "Version", + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", + "type": "string" + }, + "value": { + "title": "Value", "type": "string" } }, - "title": "MITRE D3FEND\u2122", + "title": "Discovery Details", "type": "object" }, - "data_classification": { + "sso": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], "properties": { - "category": { - "title": "Category", + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "category_id": { + "auth_protocol_id": { "enum": [ 0, 1, @@ -1393,114 +1267,247 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, 99 ], - "title": "Category ID", + "title": "Auth Protocol ID", "type": "integer" }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "duration_mins": { + "title": "SSO Session Duration", "type": "integer" }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" }, - "size": { - "title": "Size", + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "src_url": { - "title": "Source URL", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "status_details": { + "scopes": { "items": { "type": "string" }, - "title": "Status Details", + "title": "Scopes", "type": "array" }, - "status_id": { + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Data Classification", + "title": "Token", "type": "object" }, - "device": { + "api": { + "additionalProperties": false, + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "operation": { + "title": "Operation", + "type": "string" + }, + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" + }, + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "d3f_tactic" ] }, { "required": [ - "instance_uid" + "d3f_technique" ] + } + ], + "properties": { + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" }, - { - "required": [ - "interface_name" - ] + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" }, - { - "required": [ - "interface_uid" - ] + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" }, - { - "required": [ - "ip" - ] + "provider": { + "title": "Provider", + "type": "string" + }, + "score": { + "title": "Reputation Score", + "type": "string" }, + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", + "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ { "required": [ "name" @@ -1513,199 +1520,192 @@ } ], "properties": { - "agent_list": { + "countermeasures": { "items": { - "$ref": "#/$defs/agent" + "$ref": "#/$defs/d3fend" }, - "title": "Agent List", + "title": "Countermeasures", "type": "array" }, - "autoscale_uid": { - "title": "Autoscale UID", + "name": { + "title": "Name", "type": "string" }, - "boot_time": { - "title": "Boot Time", - "type": "integer" + "src_url": { + "title": "Source URL", + "type": "string" }, - "boot_uid": { - "title": "Boot UID", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] }, - "created_time": { - "title": "Created Time", - "type": "integer" + { + "required": [ + "country" + ] }, - "desc": { - "title": "Description", - "type": "string" + { + "required": [ + "postal_code" + ] }, - "domain": { - "title": "Domain", + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", "type": "string" }, - "eid": { - "title": "EID", + "city": { + "title": "City", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" + "continent": { + "title": "Continent", + "type": "string" }, - "groups": { + "coordinates": { "items": { - "$ref": "#/$defs/group" + "type": "number" }, - "title": "Groups", + "title": "Coordinates", "type": "array" }, - "hostname": { - "title": "Hostname", + "country": { + "title": "Country", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "desc": { + "title": "Description", + "type": "string" }, - "hypervisor": { - "title": "Hypervisor", + "geodetic_altitude": { + "title": "Geodetic Altitude", "type": "string" }, - "iccid": { - "title": "ICCID", + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", "type": "string" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "geohash": { + "title": "Geohash", + "type": "string" }, - "imei": { - "title": "IMEI", + "horizontal_accuracy": { + "title": "Horizontal Accuracy", "type": "string" }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" + "is_on_premises": { + "title": "On-Premises", + "type": "boolean" }, - "instance_uid": { - "title": "Instance ID", + "isp": { + "title": "ISP Name", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" + "lat": { + "title": "Latitude", + "type": "number" }, - "interface_uid": { - "title": "Network Interface ID", + "long": { + "title": "Longitude", + "type": "number" + }, + "postal_code": { + "title": "Postal Code", "type": "string" }, - "ip": { - "title": "IP Address", + "pressure_altitude": { + "title": "Pressure Altitude", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" + "provider": { + "title": "Provider", + "type": "string" }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "region": { + "title": "Region", + "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" }, - "mac": { - "title": "MAC Address", + "domain": { + "title": "Domain", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" }, - "meid": { - "title": "MEID", - "type": "string" + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" }, - "model": { - "title": "Model", + "issuer": { + "title": "Issuer Details", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" }, - "region": { - "title": "Region", - "type": "string" + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" }, - "risk_level": { - "title": "Risk Level", + "state": { + "title": "State", "type": "string" }, - "risk_level_id": { + "state_id": { "enum": [ 0, 1, @@ -1714,26 +1714,45 @@ 4, 99 ], - "title": "Risk Level ID", + "title": "State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "tenant_uid": { + "title": "Tenant UID", + "type": "string" }, - "subnet": { - "title": "Subnet", + "uid": { + "title": "Unique ID", "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "url_string": { + "title": "Configuration URL", "type": "string" + } + }, + "title": "Identity Provider", + "type": "object" + }, + "message_context": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "application" + ] }, - "type": { - "title": "Type", + { + "required": [ + "service" + ] + } + ], + "properties": { + "ai_role": { + "title": "AI Role", "type": "string" }, - "type_id": { + "ai_role_id": { "enum": [ 0, 1, @@ -1742,371 +1761,497 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "AI Role ID", "type": "integer" }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" + "application": { + "$ref": "#/$defs/application", + "title": "Application" }, - "uid": { - "title": "Unique ID", - "type": "string" + "completion_tokens": { + "title": "Completion Tokens", + "type": "integer" }, - "uid_alt": { - "title": "Alternate ID", + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "prompt_tokens": { + "title": "Prompt Tokens", + "type": "integer" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" + "total_tokens": { + "title": "Total Tokens", + "type": "integer" }, - "zone": { - "title": "Network Zone", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Device", + "title": "Message Context", "type": "object" }, - "device_hw_info": { + "process": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "bios_ver": { - "title": "BIOS Version", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "chassis": { - "title": "Chassis", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpu_architecture": { - "title": "CPU Architecture", + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", "type": "string" }, - "cpu_architecture_id": { + "integrity_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, 99 ], - "title": "CPU Architecture ID", + "title": "Integrity Level", "type": "integer" }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" }, - "cpu_type": { - "title": "Processor Type", + "path": { + "title": "Path", "type": "string" }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" + "pid": { + "title": "Process ID", + "type": "integer" }, - "gpu_count": { - "title": "GPU Count", + "ptid": { + "title": "Process Thread ID", "type": "integer" }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" + "sandbox": { + "title": "Sandbox", + "type": "string" }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "ram_size": { - "title": "RAM Size", + "terminated_time": { + "title": "Terminated Time", "type": "integer" }, - "serial_number": { - "title": "Serial Number", - "type": "string" + "tid": { + "title": "Thread ID", + "type": "integer" }, - "uuid": { - "title": "UUID", + "uid": { + "title": "Unique ID", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" } }, - "title": "Device Hardware Info", + "title": "Process", "type": "object" }, - "digital_signature": { + "vulnerability": { "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], "properties": { - "algorithm": { - "title": "Algorithm", + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" }, - "created_time": { - "title": "Created Time", + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", "type": "integer" }, - "developer_uid": { - "title": "Developer UID", + "exploit_ref_url": { + "title": "Exploit URL", "type": "string" }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" }, - "state": { - "title": "State", + "exploit_type": { + "title": "Exploit Type", "type": "string" }, - "state_id": { + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, 99 ], - "title": "State ID", + "title": "Fix Coverage ID", "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", "type": "integer" }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" }, - "occurrences": { + "references": { "items": { - "$ref": "#/$defs/occurrence_details" + "type": "string" }, - "title": "Occurrences", + "title": "References", "type": "array" }, - "type": { - "title": "Type", + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", "type": "string" }, - "value": { - "title": "Value", + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "title": "Discovery Details", + "title": "Vulnerability Details", "type": "object" }, - "display": { + "affected_code": { "additionalProperties": false, "properties": { - "color_depth": { - "title": "Color Depth", + "end_column": { + "title": "End Column", "type": "integer" }, - "physical_height": { - "title": "Physical Height", + "end_line": { + "title": "End Line", "type": "integer" }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "physical_width": { - "title": "Physical Width", + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", "type": "integer" }, - "scale_factor": { - "title": "Scale Factor", + "start_line": { + "title": "Start Line", "type": "integer" } }, - "title": "Display", + "required": [ + "file" + ], + "title": "Affected Code", "type": "object" }, - "dns_answer": { + "keyboard_info": { "additionalProperties": false, "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", + "function_keys": { + "title": "Function Keys", "type": "integer" }, - "rdata": { - "title": "DNS RData", + "ime": { + "title": "IME", "type": "string" }, - "ttl": { - "title": "TTL", + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", "type": "integer" }, - "type": { - "title": "Resource Record Type", + "keyboard_type": { + "title": "Keyboard Type", "type": "string" } }, - "required": [ - "rdata" - ], - "title": "DNS Answer", + "title": "Keyboard Information", "type": "object" }, - "domain_contact": { + "certificate": { "additionalProperties": false, "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" }, - "phone_number": { - "title": "Phone Number", + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", "type": "string" }, - "type": { - "title": "Domain Contact Type", + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" + "subject": { + "title": "Subject Distinguished Name", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "type_id" + "issuer", + "serial_number" ], - "title": "Domain Contact", + "title": "Digital Certificate", "type": "object" }, - "edge": { + "graph": { "additionalProperties": false, "anyOf": [ { @@ -2121,8 +2266,16 @@ } ], "properties": { - "data": { - "title": "Data" + "desc": { + "title": "Description", + "type": "string" + }, + "edges": { + "items": { + "$ref": "#/$defs/edge" + }, + "title": "Edges", + "type": "array" }, "is_directed": { "title": "Directed", @@ -2132,16 +2285,34 @@ "title": "Name", "type": "string" }, - "relation": { - "title": "Relation", - "type": "string" + "nodes": { + "items": { + "$ref": "#/$defs/node" + }, + "title": "Nodes", + "type": "array" }, - "source": { - "title": "Source", + "query_language": { + "title": "Query Language", "type": "string" }, - "target": { - "title": "Target", + "query_language_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Query Language ID", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, "uid": { @@ -2150,354 +2321,290 @@ } }, "required": [ - "source", - "target" + "nodes" ], - "title": "Edge", + "title": "Graph", "type": "object" }, - "email": { + "account": { "additionalProperties": false, "anyOf": [ { "required": [ - "from" + "name" ] }, { "required": [ - "to" + "uid" ] } ], "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" + "is_disabled": { + "title": "Disabled", + "type": "boolean" }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" + "is_locked": { + "title": "Locked", + "type": "boolean" }, - "delivered_to": { - "title": "Delivered To", - "type": "string" + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" }, - "delivered_to_list": { + "labels": { "items": { "type": "string" }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", + "title": "Labels", "type": "array" }, - "from": { - "title": "From", + "name": { + "title": "Name", "type": "string" }, - "from_list": { + "tags": { "items": { - "type": "string" + "$ref": "#/$defs/key_value_object" }, - "title": "From List", + "title": "Tags", "type": "array" }, - "from_mailbox": { - "title": "From Mailbox", + "type": { + "title": "Type", "type": "string" }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", + "type": "string" }, - "is_read": { - "title": "Read", - "type": "boolean" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" + } + }, + "title": "Authorization Result", + "type": "object" + }, + "autonomous_system": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "message_uid": { - "title": "Message UID", + { + "required": [ + "number" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "raw_header": { - "title": "Raw Header", + "number": { + "title": "Number", + "type": "integer" + } + }, + "title": "Autonomous System", + "type": "object" + }, + "classifier_details": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", "type": "string" }, - "reply_to": { - "title": "Reply To", + "type": { + "title": "Type", "type": "string" }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "required": [ + "type" + ], + "title": "Classifier Details", + "type": "object" + }, + "session": { + "additionalProperties": false, + "properties": { + "count": { + "title": "Count", + "type": "integer" }, - "sender": { - "title": "Sender", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "sender_mailbox": { - "title": "Sender Mailbox", + "expiration_reason": { + "title": "Expiration Reason", "type": "string" }, - "size": { - "title": "Size", + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "smtp_from": { - "title": "SMTP From", - "type": "string" + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" + "is_remote": { + "title": "Remote", + "type": "boolean" }, - "subject": { - "title": "Subject", + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", "type": "string" }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", + "terminal": { + "title": "Terminal", "type": "string" }, - "dmarc_override": { - "title": "DMARC Override", + "uid": { + "title": "Unique ID", "type": "string" }, - "dmarc_policy": { - "title": "DMARC Policy", + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "spf": { - "title": "SPF Status", + "uuid": { + "title": "UUID", "type": "string" } }, - "title": "Email Authentication", + "title": "Session", "type": "object" }, - "encryption_details": { + "d3f_technique": { "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "type": { - "title": "Encryption Type", - "type": "string" + { + "required": [ + "uid" + ] } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, + ], "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, "src_url": { "title": "Source URL", "type": "string" }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", + "title": "MITRE D3FEND\u2122 Technique", "type": "object" }, - "environment_variable": { + "image": { "additionalProperties": false, "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "path": { + "title": "Path", "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" }, - "score": { - "title": "EPPS Score", + "tag": { + "title": "Image Tag", "type": "string" }, - "version": { - "title": "Version", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "score" + "uid" ], - "title": "EPSS", + "title": "Image", "type": "object" }, - "extension": { + "application": { "additionalProperties": false, "anyOf": [ { @@ -2512,129 +2619,105 @@ } ], "properties": { - "name": { - "title": "Name", + "criticality": { + "title": "Business Criticality", "type": "string" }, - "uid": { - "title": "Unique ID", + "data": { + "title": "Data" + }, + "desc": { + "title": "Application Description", "type": "string" }, - "version": { - "title": "Version", + "group": { + "$ref": "#/$defs/group", + "title": "Group" + }, + "hostname": { + "title": "Hostname", "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, "name": { - "title": "Name", + "title": "Application Name", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { + "owner": { "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" + "title": "Owner" }, - "company_name": { - "title": "Company Name", - "type": "string" + "resource_relationship": { + "$ref": "#/$defs/graph", + "title": "Application Relationship" }, - "confidentiality": { - "title": "Confidentiality", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "confidentiality_id": { + "risk_level_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Confidentiality ID", + "title": "Risk Level ID", "type": "integer" }, - "created_time": { - "title": "Created Time", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" + "sbom": { + "$ref": "#/$defs/sbom", + "title": "Related SBOM" }, - "desc": { - "title": "Description", + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type": { + "title": "Application Type", "type": "string" }, - "drive_type": { - "title": "Drive Type", + "uid": { + "title": "Application ID", "type": "string" }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" + "uid_alt": { + "title": "Application Alternative ID", + "type": "string" }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "ext": { - "title": "File Extension", + "version": { + "title": "Application Version", "type": "string" + } + }, + "title": "Application", + "type": "object" + }, + "script": { + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/file", + "title": "File" }, "hashes": { "items": { @@ -2643,90 +2726,111 @@ "title": "Hashes", "type": "array" }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "internal_name": { - "title": "Internal Name", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" + "type": { + "title": "Type", + "type": "string" }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "is_system": { - "title": "System", - "type": "boolean" + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" }, - "mime_type": { - "title": "MIME type", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "modified_time": { - "title": "Modified Time", + "epoch": { + "title": "Epoch", "type": "integer" }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" + "fixed_in_version": { + "title": "Fixed In Version", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, + "license_url": { + "title": "Software License URL", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "package_manager": { + "title": "Package Manager", + "type": "string" }, - "parent_folder": { - "title": "Parent Folder", + "package_manager_url": { + "title": "Package Manager URL", "type": "string" }, "path": { "title": "Path", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", + "purl": { + "title": "Package URL", "type": "string" }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" + "release": { + "title": "Software Release Details", + "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "src_url": { + "title": "Source URL", + "type": "string" }, "type": { "title": "Type", @@ -2737,97 +2841,54 @@ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, - 8, 99 ], "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", + "title": "Package UID", "type": "string" }, - "uri": { - "title": "File URI", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, "version": { "title": "Version", "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, "required": [ "name", - "type_id" + "version" ], - "title": "File", + "title": "Affected Software Package", "type": "object" }, - "fingerprint": { + "cis_control": { "additionalProperties": false, "properties": { - "algorithm": { - "title": "Algorithm", + "desc": { + "title": "Description", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "value": { - "title": "Value", + "version": { + "title": "Version", "type": "string" } }, "required": [ - "algorithm_id", - "value" + "name" ], - "title": "Fingerprint", + "title": "CIS Control", "type": "object" }, - "firewall_rule": { + "analytic": { "additionalProperties": false, "anyOf": [ { @@ -2842,69 +2903,49 @@ } ], "properties": { - "category": { - "title": "Category", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "condition": { - "title": "Condition", + "category": { + "title": "Category", "type": "string" }, "desc": { "title": "Description", "type": "string" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "match_details": { + "related_analytics": { "items": { - "type": "string" + "$ref": "#/$defs/analytic" }, - "title": "Match Details", + "title": "Related Analytics", "type": "array" }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", + "state": { + "title": "State", "type": "string" }, - "rate_limit": { - "title": "Rate Limit", + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", "type": "integer" }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { + "type_id": { "enum": [ 0, 1, @@ -2914,46 +2955,31 @@ 5, 6, 7, + 8, + 9, + 10, + 11, 99 ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", + "title": "Type ID", "type": "integer" }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "vram_mode": { - "title": "VRAM Mode", + "version": { + "title": "Version", "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" } }, - "title": "GPU Information", + "required": [ + "type_id" + ], + "title": "Analytic", "type": "object" }, - "graph": { + "edge": { "additionalProperties": false, "anyOf": [ { @@ -2968,16 +2994,8 @@ } ], "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "edges": { - "items": { - "$ref": "#/$defs/edge" - }, - "title": "Edges", - "type": "array" + "data": { + "title": "Data" }, "is_directed": { "title": "Directed", @@ -2987,34 +3005,16 @@ "title": "Name", "type": "string" }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" - }, - "query_language": { - "title": "Query Language", + "relation": { + "title": "Relation", "type": "string" }, - "query_language_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Query Language ID", - "type": "integer" + "source": { + "title": "Source", + "type": "string" }, - "type": { - "title": "Type", + "target": { + "title": "Target", "type": "string" }, "uid": { @@ -3023,194 +3023,166 @@ } }, "required": [ - "nodes" + "source", + "target" ], - "title": "Graph", + "title": "Edge", "type": "object" }, - "group": { + "actor": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "app_name" ] }, { "required": [ - "uid" + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" ] } ], "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", + "app_name": { + "title": "Application Name", "type": "string" }, - "name": { - "title": "Name", + "app_uid": { + "title": "Application ID", "type": "string" }, - "privileges": { + "authorizations": { "items": { - "type": "string" + "$ref": "#/$defs/authorization" }, - "title": "Privileges", + "title": "Authorization Information", "type": "array" }, - "type": { - "title": "Group Type", - "type": "string" + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" }, - "uid": { - "title": "Unique ID", + "invoked_by": { + "title": "Invoked by", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" + "process": { + "$ref": "#/$defs/process", + "title": "Process" }, - "value": { - "title": "Value", - "type": "string" + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" } }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", + "title": "Actor", "type": "object" }, - "http_request": { + "cloud": { "additionalProperties": false, "properties": { - "args": { - "title": "HTTP Arguments", - "type": "string" - }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", + "cloud_partition": { + "title": "Cloud Partition", "type": "string" }, - "length": { - "title": "Request Length", - "type": "integer" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "referrer": { - "title": "HTTP Referrer", + "project_uid": { + "title": "Project ID", "type": "string" }, - "uid": { - "title": "Unique ID", + "provider": { + "title": "Cloud Provider", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", + "region": { + "title": "Region", "type": "string" }, - "version": { - "title": "HTTP Version", + "zone": { + "title": "Cloud Availability Zone", "type": "string" - }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" } }, - "title": "HTTP Request", + "required": [ + "provider" + ], + "title": "Cloud", "type": "object" }, - "http_response": { + "trace": { "additionalProperties": false, "properties": { - "body_length": { - "title": "Response Body Length", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "code": { - "title": "Response Code", + "end_time": { + "title": "End Time", "type": "integer" }, - "content_type": { - "title": "HTTP Content Type", - "type": "string" - }, - "http_headers": { + "flags": { "items": { - "$ref": "#/$defs/http_header" + "type": "string" }, - "title": "HTTP Headers", + "title": "Flags", "type": "array" }, - "latency": { - "title": "Latency", - "type": "integer" + "service": { + "$ref": "#/$defs/service", + "title": "Service" }, - "length": { - "title": "Response Length", - "type": "integer" + "span": { + "$ref": "#/$defs/span", + "title": "Span" }, - "message": { - "title": "Message", - "type": "string" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "status": { - "title": "Status", + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "code" + "uid" ], - "title": "HTTP Response", + "title": "Trace", "type": "object" }, - "idp": { + "ai_model": { "additionalProperties": false, "anyOf": [ { @@ -3225,588 +3197,668 @@ } ], "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", + "ai_provider": { + "title": "AI Provider", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", + "uid": { + "title": "Unique ID", "type": "string" }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "ai_provider" + ], + "title": "AI Model", + "type": "object" + }, + "file": { + "additionalProperties": false, + "properties": { + "parent_folder": { + "title": "Parent Folder", + "type": "string" }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" + "is_system": { + "title": "System", + "type": "boolean" }, - "state": { - "title": "State", - "type": "string" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" }, - "state_id": { + "confidentiality_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, 99 ], - "title": "State ID", + "title": "Confidentiality ID", "type": "integer" }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" }, - "name": { - "title": "Name", - "type": "string" + "is_readonly": { + "title": "Read-Only", + "type": "boolean" }, - "path": { - "title": "Path", + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "ext": { + "title": "File Extension", "type": "string" }, - "tag": { - "title": "Image Tag", + "company_name": { + "title": "Company Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "attributes": { + "title": "Attributes", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "desc": { + "title": "Description", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" + "type": { + "title": "Type", + "type": "string" }, - "bulletin": { - "title": "Patch Bulletin", + "path": { + "title": "Path", "type": "string" }, - "classification": { - "title": "Classification", + "uri": { + "title": "File URI", + "type": "string" + }, + "is_deleted": { + "title": "Deleted", + "type": "boolean" + }, + "confidentiality": { + "title": "Confidentiality", + "type": "string" + }, + "drive_type": { + "title": "Drive Type", "type": "string" }, "created_time": { "title": "Created Time", "type": "integer" }, - "install_state": { - "title": "Install State", + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" + }, + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" + }, + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", "type": "string" }, - "install_state_id": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, + 8, 99 ], - "title": "Install State ID", + "title": "Type ID", "type": "integer" }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "size": { + "title": "Size", + "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "severity": { - "title": "Severity", + "internal_name": { + "title": "Internal Name", "type": "string" }, - "size": { - "title": "Size", + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" + }, + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", "type": "integer" }, - "src_url": { - "title": "Source URL", + "security_descriptor": { + "title": "Security Descriptor", "type": "string" }, - "title": { - "title": "Title", + "volume": { + "title": "Volume", "type": "string" }, - "uid": { - "title": "Unique ID", + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", + "type": "string" + }, + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Digital Signatures", + "type": "array" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "KB Article", + "required": [ + "name", + "type_id" + ], + "title": "File", "type": "object" }, - "key_value_object": { + "remediation": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], "properties": { - "name": { - "title": "Name", - "type": "string" + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" }, - "value": { - "title": "Value", + "desc": { + "title": "Description", "type": "string" }, - "values": { + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { "items": { "type": "string" }, - "title": "Values", + "title": "Knowledgebase Articles", + "type": "array" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", "type": "array" } }, "required": [ - "name" + "desc" ], - "title": "Key:Value object", + "title": "Remediation", "type": "object" }, - "keyboard_info": { + "email": { "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" + "anyOf": [ + { + "required": [ + "from" + ] }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" + { + "required": [ + "to" + ] } - }, - "required": [ - "phase_id" ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, "properties": { - "cost_center": { - "title": "Cost Center", + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" + }, + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" }, - "department": { - "title": "Department", + "from": { + "title": "From", "type": "string" }, - "display_name": { - "title": "Display Name", + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" + }, + "from_mailbox": { + "title": "From Mailbox", "type": "string" }, - "email_addrs": { + "from_mailboxes": { "items": { "type": "string" }, - "title": "Email Addresses", + "title": "From Mailboxes", "type": "array" }, - "employee_uid": { - "title": "Employee ID", - "type": "string" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "given_name": { - "title": "Given Name", + "is_read": { + "title": "Read", + "type": "boolean" + }, + "message_uid": { + "title": "Message UID", "type": "string" }, - "hire_time": { - "title": "Hire Time", - "type": "integer" + "raw_header": { + "title": "Raw Header", + "type": "string" }, - "job_title": { - "title": "Job Title", + "reply_to": { + "title": "Reply To", "type": "string" }, - "labels": { + "reply_to_list": { "items": { "type": "string" }, - "title": "Labels", + "title": "Reply To List", "type": "array" }, - "last_login_time": { - "title": "Last Login", - "type": "integer" + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" }, - "ldap_cn": { - "title": "LDAP Common Name", + "return_path": { + "title": "Return Path", "type": "string" }, - "ldap_dn": { - "title": "LDAP Distinguished Name", + "sender": { + "title": "Sender", "type": "string" }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" + "sender_mailbox": { + "title": "Sender Mailbox", + "type": "string" }, - "modified_time": { - "title": "Modified Time", + "size": { + "title": "Size", "type": "integer" }, - "office_location": { - "title": "Office Location", + "smtp_from": { + "title": "SMTP From", "type": "string" }, - "phone_number": { - "title": "Telephone Number", + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", "type": "string" }, - "surname": { - "title": "Surname", + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, + "uid": { + "title": "Email Thread UID", "type": "string" }, - "tags": { + "urls": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/url" }, - "title": "Tags", + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", "type": "array" } }, - "title": "LDAP Person", + "title": "Email", "type": "object" }, - "location": { + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "city" + "name" ] }, { "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" + "uid" ] } ], "properties": { - "aerial_height": { - "title": "Aerial Height", + "name": { + "title": "Name", "type": "string" }, - "city": { - "title": "City", + "src_url": { + "title": "Source URL", "type": "string" }, - "continent": { - "title": "Continent", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Technique", + "type": "object" + }, + "http_request": { + "additionalProperties": false, + "properties": { + "args": { + "title": "HTTP Arguments", "type": "string" }, - "coordinates": { + "body_length": { + "title": "Request Body Length", + "type": "integer" + }, + "http_headers": { "items": { - "type": "number" + "$ref": "#/$defs/http_header" }, - "title": "Coordinates", + "title": "HTTP Headers", "type": "array" }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", "type": "string" }, - "geohash": { - "title": "Geohash", - "type": "string" + "length": { + "title": "Request Length", + "type": "integer" }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", + "referrer": { + "title": "HTTP Referrer", "type": "string" }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "pressure_altitude": { - "title": "Pressure Altitude", + "user_agent": { + "title": "HTTP User-Agent", "type": "string" }, - "provider": { - "title": "Provider", + "version": { + "title": "HTTP Version", "type": "string" }, - "region": { - "title": "Region", - "type": "string" + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" } }, - "title": "Geo Location", + "title": "HTTP Request", "type": "object" }, - "logger": { + "cvss": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "base_score": { + "title": "Base Score", + "type": "number" }, - "log_format": { - "title": "Log Format", + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", "type": "string" }, - "log_level": { - "title": "Log Level", - "type": "string" + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" }, - "log_name": { - "title": "Log Name", - "type": "string" + "overall_score": { + "title": "Overall Score", + "type": "number" }, - "log_provider": { - "title": "Log Provider", + "severity": { + "title": "Severity", "type": "string" }, - "log_version": { - "title": "Log Version", + "src_url": { + "title": "Source URL", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", + "vector_string": { + "title": "Vector String", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, "version": { "title": "Version", "type": "string" } }, - "title": "Logger", + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", "type": "object" }, - "long_string": { + "fingerprint": { "additionalProperties": false, "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "algorithm": { + "title": "Algorithm", + "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 99 + ], + "title": "Algorithm ID", "type": "integer" }, "value": { @@ -3815,111 +3867,69 @@ } }, "required": [ + "algorithm_id", "value" ], - "title": "Long String", + "title": "Fingerprint", "type": "object" }, - "malware": { + "process_entity": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "cmd_line" ] }, { "required": [ - "uid" + "cpid" ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" + { + "required": [ + "name" + ] }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" + { + "required": [ + "path" + ] }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" + { + "required": [ + "pid" + ] }, - "name": { - "title": "Name", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "cmd_line": { + "title": "Command Line", "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "provider": { - "title": "Provider", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "name": { + "title": "Name", "type": "string" }, - "severity": { - "title": "Severity", + "path": { + "title": "Path", "type": "string" }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", + "pid": { + "title": "Process ID", "type": "integer" }, "uid": { @@ -3927,54 +3937,23 @@ "type": "string" } }, - "required": [ - "classification_ids" - ], - "title": "Malware", + "title": "Process Entity", "type": "object" }, - "malware_scan_info": { + "observable": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "end_time": { - "title": "End Time", - "type": "integer" + "event_uid": { + "title": "Event UID", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, "type": { "title": "Type", @@ -3990,277 +3969,230 @@ 5, 6, 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, 99 ], "title": "Type ID", "type": "integer" }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", + "type_uid": { + "title": "Type ID", "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" } }, "required": [ "type_id" ], - "title": "Malware Scan Info", + "title": "Observable", "type": "object" }, - "message_context": { + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Header", + "type": "object" + }, + "attack": { "additionalProperties": false, "anyOf": [ { "required": [ - "application" + "sub_technique" ] }, { "required": [ - "service" + "tactic" + ] + }, + { + "required": [ + "technique" ] } ], "properties": { - "ai_role": { - "title": "AI Role", - "type": "string" + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" }, - "ai_role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "AI Role ID", - "type": "integer" - }, - "application": { - "$ref": "#/$defs/application", - "title": "Application" - }, - "completion_tokens": { - "title": "Completion Tokens", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" }, - "prompt_tokens": { - "title": "Prompt Tokens", - "type": "integer" + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "tactics": { + "items": { + "$ref": "#/$defs/tactic" + }, + "title": "Tactics", + "type": "array" }, - "total_tokens": { - "title": "Total Tokens", - "type": "integer" + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" }, - "uid": { - "title": "Unique ID", + "version": { + "title": "Version", "type": "string" } }, - "title": "Message Context", + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", "type": "object" }, - "metadata": { + "network_interface": { "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "log_name": { - "title": "Log Name", - "type": "string" + { + "required": [ + "ip" + ] }, - "log_provider": { - "title": "Log Provider", - "type": "string" + { + "required": [ + "mac" + ] }, - "log_source": { - "title": "Log Source", - "type": "string" + { + "required": [ + "name" + ] }, - "log_version": { - "title": "Log Version", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", + "ip": { + "title": "IP Address", "type": "string" }, - "original_time": { - "title": "Original Time", + "mac": { + "title": "MAC Address", "type": "string" }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", + "name": { + "title": "Name", "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", + "namespace": { + "title": "Namespace", "type": "string" }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { + "open_ports": { "items": { - "$ref": "#/$defs/transformation_info" + "$ref": "#/$defs/port_info" }, - "title": "Transformation Info", + "title": "Open Ports", "type": "array" }, - "transmit_time": { - "title": "Transmission Time", + "subnet_prefix": { + "title": "Subnet Prefix Length", "type": "integer" }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "name", - "value" - ], - "title": "Metric", + "title": "Network Interface", "type": "object" }, - "mitigation": { + "user": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "account" + ] + }, { "required": [ "name" @@ -4273,203 +4205,132 @@ } ], "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "src_url": { - "title": "Source URL", + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "uid": { - "title": "Unique ID", + "display_name": { + "title": "Display Name", "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_endpoint": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" }, "domain": { "title": "Domain", "type": "string" }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", + "email_addr": { + "title": "Email Address", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "forward_addr": { + "title": "Forwarding Address", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "full_name": { + "title": "Full Name", "type": "string" }, - "intermediate_ips": { + "groups": { "items": { - "type": "string" + "$ref": "#/$defs/group" }, - "title": "Intermediate IP Addresses", + "title": "Groups", "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" + "has_mfa": { + "title": "MFA Assigned", + "type": "boolean" }, - "isp": { - "title": "ISP Name", - "type": "string" + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" }, - "isp_org": { - "title": "ISP Org", + "name": { + "title": "Name", "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "mac_vendor": { - "title": "MAC Vendor", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "programmatic_credentials": { + "items": { + "$ref": "#/$defs/programmatic_credential" + }, + "title": "Programmatic Credentials", + "type": "array" }, - "network_scope": { - "title": "Network Scope", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "network_scope_id": { + "risk_level_id": { "enum": [ 0, 1, 2, + 3, + 4, 99 ], - "title": "Network Scope ID", + "title": "Risk Level ID", "type": "integer" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "type": { + "title": "Type", + "type": "string" }, - "port": { - "title": "Port", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" + "uid": { + "title": "Unique ID", + "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "uid_alt": { + "title": "Alternate ID", "type": "string" + } + }, + "title": "User", + "type": "object" + }, + "auth_factor": { + "additionalProperties": false, + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "svc_name": { - "title": "Service Name", + "email_addr": { + "title": "Email Address", "type": "string" }, - "type": { - "title": "Type", + "factor_type": { + "title": "Factor Type", "type": "string" }, - "type_id": { + "factor_type_id": { "enum": [ 0, 1, @@ -4483,292 +4344,226 @@ 9, 10, 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "Factor Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" }, - "vlan_uid": { - "title": "VLAN", - "type": "string" + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" }, - "vpc_uid": { - "title": "VPC UID", + "phone_number": { + "title": "Phone Number", "type": "string" }, - "zone": { - "title": "Network Zone", + "provider": { + "title": "Provider", "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" } + }, + "required": [ + "factor_type_id" ], + "title": "Authentication Factor", + "type": "object" + }, + "osint": { + "additionalProperties": false, "properties": { - "hostname": { - "title": "Hostname", + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" + }, + "external_uid": { + "title": "External ID", "type": "string" }, - "ip": { - "title": "IP Address", + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", "type": "string" }, - "mac": { - "title": "MAC Address", + "detection_pattern": { + "title": "Detection Pattern", "type": "string" }, - "name": { - "title": "Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "namespace": { - "title": "Namespace", + "category": { + "title": "Category", "type": "string" }, - "open_ports": { + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "subdomains": { "items": { - "$ref": "#/$defs/port_info" + "type": "string" }, - "title": "Open Ports", + "title": "Related Subdomains", "type": "array" }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" + "confidence": { + "title": "Confidence", + "type": "string" + }, + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, "type": { "title": "Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", + "uploaded_time": { + "title": "Uploaded Time", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "network_proxy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - { - "required": [ - "interface_name" - ] + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - { - "required": [ - "interface_uid" - ] + "comment": { + "title": "Analyst Comments", + "type": "string" }, - { - "required": [ - "ip" - ] + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - { - "required": [ - "name" - ] + "value": { + "title": "Indicator", + "type": "string" }, - { - "required": [ - "svc_name" - ] + "created_time": { + "title": "Created Time", + "type": "integer" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { + "intrusion_sets": { "items": { - "$ref": "#/$defs/agent" + "type": "string" }, - "title": "Agent List", + "title": "Intrusion Sets", "type": "array" }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" }, - "domain": { - "title": "Domain", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "fingerprints": { + "attacks": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/attack" }, - "title": "Fingerprints", + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", "type": "array" }, - "hostname": { - "title": "Hostname", - "type": "string" + "related_analytics": { + "items": { + "$ref": "#/$defs/analytic" + }, + "title": "Related Analytics", + "type": "array" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "file": { + "$ref": "#/$defs/file", + "title": "Related File" }, - "instance_uid": { - "title": "Instance ID", - "type": "string" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "interface_name": { - "title": "Network Interface Name", + "name": { + "title": "Name", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" }, - "intermediate_ips": { + "kill_chain": { "items": { - "type": "string" + "$ref": "#/$defs/kill_chain_phase" }, - "title": "Intermediate IP Addresses", + "title": "Kill Chain", "type": "array" }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { + "detection_pattern_type_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, 99 ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", + "title": "Detection Pattern Type ID", "type": "integer" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", + "detection_pattern_type": { + "title": "Detection Pattern", "type": "string" }, - "svc_name": { - "title": "Service Name", - "type": "string" + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" }, "type_id": { "enum": [ @@ -4787,42 +4582,91 @@ 12, 13, 14, - 15, 99 ], - "title": "Type ID", + "title": "Indicator Type ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "vlan_uid": { - "title": "VLAN", + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", "type": "string" }, - "vpc_uid": { - "title": "VPC UID", + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "zone": { - "title": "Network Zone", + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "subnet": { + "title": "Related Subnet", "type": "string" + }, + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" + }, + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" } }, - "title": "Network Proxy Endpoint", + "required": [ + "type_id", + "value" + ], + "title": "OSINT", "type": "object" }, - "node": { + "san": { "additionalProperties": false, "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" @@ -4830,182 +4674,83 @@ "type": { "title": "Type", "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" } }, "required": [ - "uid" + "name", + "type" ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", + "title": "Subject Alternative Name", "type": "object" }, - "observable": { + "occurrence_details": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cell_name" + ] + }, + { + "required": [ + "column_name" + ] + }, + { + "required": [ + "column_number" + ] + }, + { + "required": [ + "end_line" + ] + }, + { + "required": [ + "json_path" + ] + }, + { + "required": [ + "page_number" + ] + }, + { + "required": [ + "record_index_in_array" + ] + }, + { + "required": [ + "row_number" + ] + }, + { + "required": [ + "start_line" + ] + } + ], "properties": { - "event_uid": { - "title": "Event UID", + "cell_name": { + "title": "Cell Name", "type": "string" }, - "name": { - "title": "Name", + "column_name": { + "title": "Column Name", "type": "string" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "column_number": { + "title": "Column Number", + "type": "integer" }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", "type": "string" }, "page_number": { @@ -5028,7 +4773,7 @@ "title": "Occurrence Details", "type": "object" }, - "organization": { + "firewall_rule": { "additionalProperties": false, "anyOf": [ { @@ -5043,91 +4788,164 @@ } ], "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "condition": { + "title": "Condition", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { + "items": { + "type": "string" + }, + "title": "Match Details", + "type": "array" + }, + "match_location": { + "title": "Match Location", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "ou_name": { - "title": "Org Unit Name", + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "sensitivity": { + "title": "Sensitivity", "type": "string" }, - "ou_uid": { - "title": "Org Unit ID", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Organization", + "title": "Firewall Rule", "type": "object" }, - "os": { + "threat_actor": { "additionalProperties": false, "properties": { - "build": { - "title": "OS Build", + "name": { + "title": "Name", "type": "string" }, - "country": { - "title": "Country", + "type": { + "title": "Threat Actor Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Threat Actor Type ID", + "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", "type": "string" }, "cpe_name": { "title": "The product CPE identifier", "type": "string" }, - "cpu_bits": { - "title": "CPU Bits", + "epoch": { + "title": "Epoch", "type": "integer" }, - "edition": { - "title": "OS Edition", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "kernel_release": { - "title": "Kernel Release", + "license": { + "title": "Software License", "type": "string" }, - "lang": { - "title": "Language", + "license_url": { + "title": "Software License URL", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "sp_name": { - "title": "OS Service Pack", + "package_manager": { + "title": "Package Manager", "type": "string" }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" }, - "type": { - "title": "Type", + "purl": { + "title": "Package URL", "type": "string" }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 99 ], "title": "Type ID", "type": "integer" }, + "uid": { + "title": "Package UID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, "version": { "title": "Version", "type": "string" @@ -5135,382 +4953,420 @@ }, "required": [ "name", - "type_id" + "version" ], - "title": "Operating System (OS)", + "title": "Software Package", "type": "object" }, - "osint": { + "transformation_info": { "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, - "comment": { - "title": "Analyst Comments", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "lang": { + "title": "Language", "type": "string" }, - "confidence": { - "title": "Confidence", + "name": { + "title": "Name", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "created_time": { - "title": "Created Time", + "time": { + "title": "Event Time", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", + "uid": { + "title": "Unique ID", "type": "string" }, - "detection_pattern_type": { - "title": "Detection Pattern", + "url_string": { + "title": "URL String", "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", + } + }, + "title": "Transformation Info", + "type": "object" + }, + "response": { + "additionalProperties": false, + "properties": { + "code": { + "title": "Response Code", "type": "integer" }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "data": { + "title": "Data" }, - "external_uid": { - "title": "External ID", + "error": { + "title": "Error Code", "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" + "error_message": { + "title": "Error Message", + "type": "string" }, - "intrusion_sets": { + "flags": { "items": { "type": "string" }, - "title": "Intrusion Sets", + "title": "Flags", "type": "array" }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" + "message": { + "title": "Message", + "type": "string" + } + }, + "title": "Response Elements", + "type": "object" + }, + "reporter": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "hostname" + ] }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + { + "required": [ + "ip" + ] }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + { + "required": [ + "name" + ] }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "hostname": { + "title": "Hostname", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "ip": { + "title": "IP Address", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "Reporter", + "type": "object" + }, + "url": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { + { + "required": [ + "url_string" + ] + } + ], + "properties": { + "categories": { "items": { - "$ref": "#/$defs/digital_signature" + "type": "string" }, - "title": "Related Digital Signatures", + "title": "Website Categorization", "type": "array" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { + "category_ids": { "items": { - "type": "string" + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" }, - "title": "Related Subdomains", + "title": "Website Categorization IDs", "type": "array" }, - "subnet": { - "title": "Related Subnet", + "domain": { + "title": "Domain", "type": "string" }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", + "hostname": { + "title": "Hostname", "type": "string" }, - "type": { - "title": "Type", + "path": { + "title": "Path", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", + "port": { + "title": "Port", "type": "integer" }, - "uid": { - "title": "Unique ID", + "query_string": { + "title": "HTTP Query String", "type": "string" }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", + "resource_type": { + "title": "Resource Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "scheme": { + "title": "Scheme", "type": "string" }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" + "subdomain": { + "title": "Subdomain", + "type": "string" }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" + "url_string": { + "title": "URL String", + "type": "string" } }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", + "title": "Uniform Resource Locator", "type": "object" }, - "package": { + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "name": { "title": "Name", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "uid": { + "title": "Unique ID", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "version": { + "title": "Version", "type": "string" - }, - "purl": { - "title": "Package URL", + } + }, + "required": [ + "version" + ], + "title": "Schema Extension", + "type": "object" + }, + "gpu_info": { + "additionalProperties": false, + "properties": { + "bus_type": { + "title": "Bus Type", "type": "string" }, - "release": { - "title": "Software Release Details", + "bus_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Bus Type ID", + "type": "integer" + }, + "cores": { + "title": "Cores", + "type": "integer" + }, + "model": { + "title": "Model", "type": "string" }, - "src_url": { - "title": "Source URL", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "type": { - "title": "Type", + "vram_mode": { + "title": "VRAM Mode", "type": "string" }, - "type_id": { + "vram_mode_id": { "enum": [ 0, 1, 2, 99 ], - "title": "Type ID", + "title": "VRAM Mode ID", "type": "integer" }, - "uid": { - "title": "Package UID", - "type": "string" + "vram_size": { + "title": "VRAM Size", + "type": "integer" + } + }, + "title": "GPU Information", + "type": "object" + }, + "port_info": { + "additionalProperties": false, + "properties": { + "port": { + "title": "Port", + "type": "integer" }, - "vendor_name": { - "title": "Vendor Name", + "protocol_name": { + "title": "Protocol Name", "type": "string" }, - "version": { - "title": "Version", - "type": "string" + "protocol_num": { + "title": "Protocol Number", + "type": "integer" } }, "required": [ - "name", - "version" + "port" ], - "title": "Software Package", + "title": "Port Information", "type": "object" }, - "policy": { + "service": { "additionalProperties": false, "anyOf": [ { @@ -5518,11 +5374,6 @@ "name" ] }, - { - "required": [ - "type" - ] - }, { "required": [ "uid" @@ -5530,28 +5381,23 @@ } ], "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "uid": { "title": "Unique ID", @@ -5562,42 +5408,96 @@ "type": "string" } }, - "title": "Policy", + "title": "Service", "type": "object" }, - "port_info": { + "metric": { "additionalProperties": false, "properties": { - "port": { - "title": "Port", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "protocol_name": { - "title": "Protocol Name", + "value": { + "title": "Value", "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" + "data": { + "title": "Data" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "uid": { + "title": "Unique ID", + "type": "string" } }, "required": [ - "port" + "uid" ], - "title": "Port Information", + "title": "Request Elements", "type": "object" }, - "process": { + "sub_technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "cpid" + "name" ] }, { "required": [ - "pid" + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE Sub-technique", + "type": "object" + }, + "container": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" ] }, { @@ -5607,132 +5507,178 @@ } ], "properties": { - "ancestry": { + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "labels": { "items": { - "$ref": "#/$defs/process_entity" + "type": "string" }, - "title": "Ancestry", + "title": "Labels", "type": "array" }, - "cmd_line": { - "title": "Command Line", + "name": { + "title": "Name", "type": "string" }, - "cpid": { - "title": "Common Process Identifier", + "network_driver": { + "title": "Network Driver", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "orchestrator": { + "title": "Orchestrator", + "type": "string" }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" + "pod_uuid": { + "title": "Pod UUID", + "type": "string" }, - "file": { - "$ref": "#/$defs/file", - "title": "File" + "runtime": { + "title": "Runtime", + "type": "string" }, - "hosted_services": { + "size": { + "title": "Size", + "type": "integer" + }, + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { "items": { - "$ref": "#/$defs/win_win_service" + "$ref": "#/$defs/key_value_object" }, - "title": "Hosted Services", + "title": "Tags", "type": "array" }, - "integrity": { - "title": "Integrity", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "Container", + "type": "object" + }, + "malware": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "classification_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" + }, + "title": "Classification IDs", + "type": "array" }, - "lineage": { + "classifications": { "items": { "type": "string" }, - "title": "Lineage", + "title": "Classifications", "type": "array" }, - "loaded_modules": { + "cves": { "items": { - "type": "string" + "$ref": "#/$defs/cve" }, - "title": "Loaded Modules", + "title": "CVE List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", "type": "array" }, "name": { "title": "Name", "type": "string" }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" }, "path": { "title": "Path", "type": "string" }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", + "provider": { + "title": "Provider", "type": "string" }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" + "severity": { + "title": "Severity", + "type": "string" }, - "tid": { - "title": "Thread ID", + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, - "title": "Process", + "required": [ + "classification_ids" + ], + "title": "Malware", "type": "object" }, - "process_entity": { + "win_win_service": { "additionalProperties": false, "anyOf": [ { @@ -5742,27 +5688,32 @@ }, { "required": [ - "cpid" + "service_category_id" ] }, { "required": [ - "name" + "service_dependencies" ] }, { "required": [ - "path" + "service_error_control_id" ] }, { "required": [ - "pid" + "service_start_name" ] }, { "required": [ - "uid" + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" ] } ], @@ -5771,154 +5722,180 @@ "title": "Command Line", "type": "string" }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "service_category": { + "title": "Service Category", "type": "string" }, - "pid": { - "title": "Process ID", + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" }, - "lang": { - "title": "Language", + "service_error_control": { + "title": "Service Error Control", "type": "string" }, - "name": { - "title": "Name", - "type": "string" + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" }, - "path": { - "title": "Path", - "type": "string" + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" }, - "uid": { - "title": "Unique ID", + "service_start_name": { + "title": "Service Start Name", "type": "string" }, - "url_string": { - "title": "URL String", + "service_start_type": { + "title": "Service Start Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" + "service_start_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Service Start Type ID", + "type": "integer" }, - "version": { - "title": "Version", + "service_type": { + "title": "Service Type", "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", + }, + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "uid" + "name" ], - "title": "Programmatic Credential", + "title": "Windows Service", "type": "object" }, - "remediation": { + "group": { "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "desc": { "title": "Description", "type": "string" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "domain": { + "title": "Domain", + "type": "string" }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "name": { + "title": "Name", + "type": "string" }, - "references": { + "privileges": { "items": { "type": "string" }, - "title": "References", + "title": "Privileges", "type": "array" + }, + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "required": [ - "desc" - ], - "title": "Remediation", + "title": "Group", "type": "object" }, - "reporter": { + "device": { "additionalProperties": false, "anyOf": [ { @@ -5926,6 +5903,21 @@ "hostname" ] }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, { "required": [ "ip" @@ -5943,183 +5935,196 @@ } ], "properties": { - "hostname": { - "title": "Hostname", + "region": { + "title": "Region", "type": "string" }, - "ip": { - "title": "IP Address", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "name": { - "title": "Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "interface_uid": { + "title": "Network Interface ID", + "type": "string" }, - "uid": { - "title": "Unique ID", + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "desc": { + "title": "Description", "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" }, - "provider": { - "title": "Provider", + "os_machine_uuid": { + "title": "OS Machine UUID", "type": "string" }, - "score": { - "title": "Reputation Score", + "hypervisor": { + "title": "Hypervisor", "type": "string" }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", + "type": { + "title": "Type", + "type": "string" + }, + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", + "type": "string" + }, + "first_seen_time": { + "title": "First Seen", "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" }, - "data": { - "title": "Data" + "mac": { + "title": "MAC Address", + "type": "string" }, - "flags": { + "imei_list": { "items": { "type": "string" }, - "title": "Flags", + "title": "IMEI List", "type": "array" }, - "uid": { - "title": "Unique ID", + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "resource_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" + "image": { + "$ref": "#/$defs/image", + "title": "Image" }, "created_time": { "title": "Created Time", "type": "integer" }, - "criticality": { - "title": "Criticality", - "type": "string" - }, - "data": { - "title": "Data" + "is_shared": { + "title": "Shared Device", + "type": "boolean" }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "hostname": { - "title": "Hostname", + "meid": { + "title": "MEID", "type": "string" }, - "ip": { - "title": "IP Address", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" + "zone": { + "title": "Network Zone", + "type": "string" }, - "labels": { + "groups": { "items": { - "type": "string" + "$ref": "#/$defs/group" }, - "title": "Labels", + "title": "Groups", "type": "array" }, - "modified_time": { - "title": "Modified Time", + "risk_score": { + "title": "Risk Score", "type": "integer" }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, "name": { "title": "Name", "type": "string" }, - "namespace": { - "title": "Namespace", + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", "type": "string" }, + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "last_seen_time": { + "title": "Last Seen", + "type": "integer" + }, "owner": { "$ref": "#/$defs/user", "title": "Owner" }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" + "boot_time": { + "title": "Boot Time", + "type": "integer" }, - "role": { - "title": "Role", - "type": "string" + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" }, - "role_id": { + "is_managed": { + "title": "Managed Device", + "type": "boolean" + }, + "risk_level_id": { "enum": [ 0, 1, @@ -6128,259 +6133,156 @@ 4, 99 ], - "title": "Role ID", + "title": "Risk Level ID", "type": "integer" }, - "tags": { + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", + "type": "string" + }, + "network_interfaces": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/network_interface" }, - "title": "Tags", + "title": "Network Interfaces", "type": "array" }, - "type": { - "title": "Type", + "autoscale_uid": { + "title": "Autoscale UID", "type": "string" }, - "uid": { - "title": "Unique ID", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "subnet": { + "title": "Subnet", "type": "string" }, - "version": { - "title": "Version", + "eid": { + "title": "EID", "type": "string" - } - }, - "title": "Resource Details", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", + "domain": { + "title": "Domain", "type": "string" }, - "error_message": { - "title": "Error Message", + "imei": { + "title": "IMEI", "type": "string" }, - "flags": { + "agent_list": { "items": { - "type": "string" + "$ref": "#/$defs/agent" }, - "title": "Flags", + "title": "Agent List", "type": "array" }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", + "ip": { + "title": "IP Address", "type": "string" }, - "desc": { - "title": "Description", + "hostname": { + "title": "Hostname", "type": "string" }, - "name": { - "title": "Name", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" }, - "uid": { - "title": "Unique ID", - "type": "string" + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" }, - "version": { - "title": "Version", + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "title": "Rule", + "required": [ + "type_id" + ], + "title": "Device", "type": "object" }, - "san": { + "campaign": { "additionalProperties": false, "properties": { "name": { "title": "Name", "type": "string" - }, - "type": { - "title": "Type", - "type": "string" } }, "required": [ - "name", - "type" + "name" ], - "title": "Subject Alternative Name", + "title": "Campaign", "type": "object" }, - "sbom": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "package": { - "$ref": "#/$defs/package", - "title": "Software Package" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "software_components": { - "items": { - "$ref": "#/$defs/software_component" - }, - "title": "Software Components", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", - "type": "integer" + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" }, - "uid": { - "title": "SBOM ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "CWE ID", "type": "string" } }, "required": [ - "package", - "software_components" + "uid" ], - "title": "Software Bill of Materials", + "title": "CWE", "type": "object" }, - "scim": { + "digital_signature": { "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "auth_protocol_id": { + "algorithm_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", + "title": "Algorithm ID", "type": "integer" }, + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, "created_time": { "title": "Created Time", "type": "integer" }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", + "developer_uid": { + "title": "Developer UID", "type": "string" }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" }, "state": { "title": "State", @@ -6393,61 +6295,46 @@ 2, 3, 4, + 5, + 6, + 7, + 8, + 9, + 10, 99 ], "title": "State ID", "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" } }, - "title": "SCIM", + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", "type": "object" }, - "script": { + "sbom": { "additionalProperties": false, "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "hashes": { + "package": { + "$ref": "#/$defs/package", + "title": "Software Package" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "software_components": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/software_component" }, - "title": "Hashes", + "title": "Software Components", "type": "array" }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, "type": { "title": "Type", "type": "string" @@ -6458,169 +6345,68 @@ 1, 2, 3, - 4, - 5, - 6, - 7, 99 ], "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", + "title": "SBOM ID", "type": "string" }, "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", + "title": "Version", "type": "string" } }, - "title": "Session", + "required": [ + "package", + "software_components" + ], + "title": "Software Bill of Materials", "type": "object" }, - "software_component": { + "malware_scan_info": { "additionalProperties": false, - "properties": { - "author": { - "title": "Author", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "anyOf": [ + { + "required": [ + "name" + ] }, - "license": { - "title": "Software License", - "type": "string" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "end_time": { + "title": "End Time", + "type": "integer" }, "name": { "title": "Name", "type": "string" }, - "purl": { - "title": "Package URL", - "type": "string" + "num_files": { + "title": "Scanned Files", + "type": "integer" }, - "related_component": { - "title": "Related Component", - "type": "string" + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" }, - "relationship": { - "title": "Relationship", - "type": "string" + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" }, - "relationship_id": { - "enum": [ - 0, - 1, - 99 - ], - "title": "Relationship ID", + "size": { + "title": "Size", + "type": "integer" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, "type": { @@ -6633,56 +6419,84 @@ 1, 2, 3, + 4, + 5, + 6, + 7, 99 ], "title": "Type ID", "type": "integer" }, - "version": { - "title": "Version", + "uid": { + "title": "Scan UID", "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" } }, "required": [ - "name", - "version" + "type_id" ], - "title": "Software Component", + "title": "Malware Scan Info", "type": "object" }, - "span": { + "kill_chain_phase": { "additionalProperties": false, "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "phase": { + "title": "Kill Chain Phase", + "type": "string" }, - "end_time": { - "title": "End Time", + "phase_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Kill Chain Phase ID", "type": "integer" + } + }, + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", + "type": "object" + }, + "organization": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "parent_uid": { - "title": "Parent Unique ID", + "ou_name": { + "title": "Org Unit Name", "type": "string" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", + "ou_uid": { + "title": "Org Unit ID", "type": "string" }, "uid": { @@ -6690,22 +6504,17 @@ "type": "string" } }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", + "title": "Organization", "type": "object" }, - "sso": { + "encryption_details": { "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "algorithm": { + "title": "Encryption Algorithm", "type": "string" }, - "auth_protocol_id": { + "algorithm_id": { "enum": [ 0, 1, @@ -6714,77 +6523,107 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", + "title": "Encryption Algorithm ID", "type": "integer" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", + "key_length": { + "title": "Encryption Key Length", "type": "integer" }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" + "key_uid": { + "title": "Key UID", + "type": "string" }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "login_endpoint": { - "title": "SSO Login Endpoint", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", "type": "string" }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", "type": "string" }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", + "log_level": { + "title": "Log Level", "type": "string" }, - "modified_time": { - "title": "Modified Time", + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", "type": "integer" }, "name": { "title": "Name", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" + "transmit_time": { + "title": "Transmission Time", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" }, - "vendor_name": { - "title": "Service Provider", + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "SSO", + "title": "Logger", "type": "object" }, - "sub_technique": { + "feature": { "additionalProperties": false, "anyOf": [ { @@ -6803,50 +6642,139 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "MITRE Sub-technique", + "title": "Feature", "type": "object" }, - "tactic": { + "timespan": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "duration" ] }, { "required": [ - "uid" + "duration_days" + ] + }, + { + "required": [ + "duration_hours" + ] + }, + { + "required": [ + "duration_mins" + ] + }, + { + "required": [ + "duration_months" + ] + }, + { + "required": [ + "duration_secs" + ] + }, + { + "required": [ + "duration_weeks" + ] + }, + { + "required": [ + "duration_years" + ] + }, + { + "required": [ + "end_time" + ] + }, + { + "required": [ + "start_time" ] } ], "properties": { - "name": { - "title": "Name", - "type": "string" + "duration": { + "title": "Duration Milliseconds", + "type": "integer" }, - "src_url": { - "title": "Source URL", - "type": "string" + "duration_days": { + "title": "Duration Days", + "type": "integer" }, - "uid": { - "title": "Unique ID", + "duration_hours": { + "title": "Duration Hours", + "type": "integer" + }, + "duration_mins": { + "title": "Duration Minutes", + "type": "integer" + }, + "duration_months": { + "title": "Duration Months", + "type": "integer" + }, + "duration_secs": { + "title": "Duration Seconds", + "type": "integer" + }, + "duration_weeks": { + "title": "Duration Weeks", + "type": "integer" + }, + "duration_years": { + "title": "Duration Years", + "type": "integer" + }, + "end_time": { + "title": "End Time", + "type": "integer" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "type": { + "title": "Time Span Type", "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Time Span Type ID", + "type": "integer" } }, - "title": "MITRE Tactic", + "title": "Time Span", "type": "object" }, - "technique": { + "rule": { "additionalProperties": false, "anyOf": [ { @@ -6861,31 +6789,76 @@ } ], "properties": { + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "type": { + "title": "Type", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "MITRE Technique", + "title": "Rule", "type": "object" }, - "threat_actor": { + "software_component": { "additionalProperties": false, "properties": { + "author": { + "title": "Author", + "type": "string" + }, + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" + }, + "license": { + "title": "Software License", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "related_component": { + "title": "Related Component", + "type": "string" + }, + "relationship": { + "title": "Relationship", + "type": "string" + }, + "relationship_id": { + "enum": [ + 0, + 1, + 99 + ], + "title": "Relationship ID", + "type": "integer" + }, "type": { - "title": "Threat Actor Type", + "title": "Type", "type": "string" }, "type_id": { @@ -6894,116 +6867,51 @@ 1, 2, 3, - 4, 99 ], - "title": "Threat Actor Type ID", + "title": "Type ID", "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "name" + "name", + "version" ], - "title": "Threat Actor", + "title": "Software Component", "type": "object" }, - "timespan": { + "agent": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, + "anyOf": [ { "required": [ - "end_time" + "name" ] }, { "required": [ - "start_time" + "uid" ] } ], "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" + "name": { + "title": "Agent Name", + "type": "string" }, - "start_time": { - "title": "Start Time", - "type": "integer" + "policies": { + "items": { + "$ref": "#/$defs/policy" + }, + "title": "Agent Policies", + "type": "array" }, "type": { - "title": "Time Span Type", + "title": "Agent Type", "type": "string" }, "type_id": { @@ -7020,321 +6928,348 @@ 9, 99 ], - "title": "Time Span Type ID", + "title": "Type ID", "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" } }, - "title": "Time Span", + "title": "Agent", "type": "object" }, - "token": { + "whois": { "additionalProperties": false, "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, "created_time": { - "title": "Created Time", + "title": "Registered At", "type": "integer" }, - "expiration_time": { - "title": "Expiration Time", + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", "type": "integer" }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" + "domain": { + "title": "Domain", + "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" + "domain_contacts": { + "items": { + "$ref": "#/$defs/domain_contact" + }, + "title": "Domain Contacts", + "type": "array" }, - "name": { - "title": "Name", + "email_addr": { + "title": "Registrar Abuse Email Address", "type": "string" }, - "tenant_uid": { - "title": "Tenant UID", + "isp": { + "title": "ISP Name", "type": "string" }, - "type": { - "title": "Type", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", + "last_seen_time": { + "title": "Last Updated At", "type": "integer" }, - "uid": { - "title": "Unique ID", + "name_servers": { + "items": { + "type": "string" + }, + "title": "Name Servers", + "type": "array" + }, + "phone_number": { + "title": "Registrar Abuse Phone Number", "type": "string" }, - "zone": { - "title": "Network Zone", + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { + "items": { + "type": "string" + }, + "title": "Subdomains", + "type": "array" + }, + "subnet": { + "title": "Subnet Block", "type": "string" } }, - "title": "Token", + "title": "WHOIS", "type": "object" }, - "trace": { + "key_value_object": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], "properties": { - "duration": { - "title": "Duration Milliseconds", + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" + } + }, + "required": [ + "name" + ], + "title": "Key:Value object", + "type": "object" + }, + "metadata": { + "additionalProperties": false, + "properties": { + "log_format": { + "title": "Log Source Format", + "type": "string" + }, + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" + }, + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "end_time": { - "title": "End Time", + "log_level": { + "title": "Log Level", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "flags": { + "loggers": { "items": { - "type": "string" + "$ref": "#/$defs/logger" }, - "title": "Flags", + "title": "Loggers", "type": "array" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "processed_time": { + "title": "Processed Time", + "type": "integer" }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" + "log_source": { + "title": "Log Source", + "type": "string" }, - "start_time": { - "title": "Start Time", + "logged_time": { + "title": "Logged Time", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" }, - "name": { - "title": "Name", + "log_provider": { + "title": "Log Provider", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "event_code": { + "title": "Event Code", + "type": "string" }, - "time": { - "title": "Event Time", - "type": "integer" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "uid": { - "title": "Unique ID", + "tenant_uid": { + "title": "Tenant UID", "type": "string" }, - "url_string": { - "title": "URL String", + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" + }, + "labels": { "items": { "type": "string" }, - "title": "Website Categorization", + "title": "Labels", "type": "array" }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" + "sequence": { + "title": "Sequence Number", + "type": "integer" }, - "domain": { - "title": "Domain", - "type": "string" + "transmit_time": { + "title": "Transmission Time", + "type": "integer" }, - "hostname": { - "title": "Hostname", - "type": "string" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "path": { - "title": "Path", + "original_time": { + "title": "Original Time", "type": "string" }, - "port": { - "title": "Port", - "type": "integer" + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" }, - "query_string": { - "title": "HTTP Query String", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" + } + }, + "required": [ + "product", + "version" + ], + "title": "Metadata", + "type": "object" + }, + "node": { + "additionalProperties": false, + "properties": { + "data": { + "title": "Data" }, - "resource_type": { - "title": "Resource Type", + "desc": { + "title": "Description", "type": "string" }, - "scheme": { - "title": "Scheme", + "name": { + "title": "Name", "type": "string" }, - "subdomain": { - "title": "Subdomain", + "type": { + "title": "Type", "type": "string" }, - "url_string": { - "title": "URL String", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Uniform Resource Locator", + "required": [ + "uid" + ], + "title": "Node", "type": "object" }, - "user": { + "product": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "account" - ] - }, { "required": [ "name" @@ -7347,549 +7282,614 @@ } ], "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "display_name": { - "title": "Display Name", + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, + "lang": { + "title": "Language", "type": "string" }, - "domain": { - "title": "Domain", + "name": { + "title": "Name", "type": "string" }, - "email_addr": { - "title": "Email Address", + "path": { + "title": "Path", "type": "string" }, - "forward_addr": { - "title": "Forwarding Address", + "uid": { + "title": "Unique ID", "type": "string" }, - "full_name": { - "title": "Full Name", + "url_string": { + "title": "URL String", "type": "string" }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" + "vendor_name": { + "title": "Vendor Name", + "type": "string" }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Product", + "type": "object" + }, + "advisory": { + "additionalProperties": false, + "properties": { + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" + "bulletin": { + "title": "Patch Bulletin", + "type": "string" }, - "name": { - "title": "Name", + "classification": { + "title": "Classification", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "phone_number": { - "title": "Telephone Number", + "desc": { + "title": "Description", "type": "string" }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", + "install_state": { + "title": "Install State", "type": "string" }, - "risk_level_id": { + "install_state_id": { "enum": [ 0, 1, 2, 3, - 4, 99 ], - "title": "Risk Level ID", + "title": "Install State ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "type": { - "title": "Type", - "type": "string" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" + }, + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" + }, + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" + }, + "size": { + "title": "Size", "type": "integer" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "title": { + "title": "Title", + "type": "string" + }, + "uid": { + "title": "Advisory ID", "type": "string" } }, - "title": "User", + "required": [ + "uid" + ], + "title": "Advisory", "type": "object" }, - "vulnerability": { + "network_endpoint": { "additionalProperties": false, - "oneOf": [ + "anyOf": [ { - "not": { - "required": [ - "cve", - "cwe" - ] - }, "required": [ - "advisory" + "domain" ] }, { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, "required": [ - "cve" + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "svc_name" ] }, { - "not": { - "required": [ - "advisory", - "cve" - ] - }, "required": [ - "cwe" + "uid" ] } ], "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { + "agent_list": { "items": { - "$ref": "#/$defs/affected_code" + "$ref": "#/$defs/agent" }, - "title": "Affected Code", + "title": "Agent List", "type": "array" }, - "affected_packages": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "fingerprints": { "items": { - "$ref": "#/$defs/affected_package" + "$ref": "#/$defs/fingerprint" }, - "title": "Affected Software Packages", + "title": "Fingerprints", "type": "array" }, - "category": { - "title": "Category", + "hostname": { + "title": "Hostname", "type": "string" }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" + "instance_uid": { + "title": "Instance ID", + "type": "string" }, - "dependency_chain": { - "title": "Dependency Chain", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "desc": { - "title": "Description", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" }, - "exploit_ref_url": { - "title": "Exploit URL", + "ip": { + "title": "IP Address", "type": "string" }, - "exploit_requirement": { - "title": "Exploit Requirement", + "isp": { + "title": "ISP Name", "type": "string" }, - "exploit_type": { - "title": "Exploit Type", + "isp_org": { + "title": "ISP Org", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" + "mac": { + "title": "MAC Address", + "type": "string" }, - "fix_coverage": { - "title": "Fix Coverage", + "mac_vendor": { + "title": "MAC Vendor", "type": "string" }, - "fix_coverage_id": { + "name": { + "title": "Name", + "type": "string" + }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "network_scope_id": { "enum": [ 0, 1, 2, - 3, 99 ], - "title": "Fix Coverage ID", + "title": "Network Scope ID", "type": "integer" }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "last_seen_time": { - "title": "Last Seen", + "port": { + "title": "Port", "type": "integer" }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" + "svc_name": { + "title": "Service Name", + "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "type": { + "title": "Type", + "type": "string" }, - "severity": { - "title": "Severity", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", "type": "string" }, - "title": { - "title": "Title", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "zone": { + "title": "Network Zone", "type": "string" } }, - "title": "Vulnerability Details", + "title": "Network Endpoint", "type": "object" }, - "whois": { + "d3f_tactic": { "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "anyOf": [ + { + "required": [ + "name" + ] }, - "created_time": { - "title": "Registered At", - "type": "integer" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", + "type": "string" }, - "dnssec_status": { - "title": "DNSSEC Status", + "src_url": { + "title": "Source URL", "type": "string" }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", "type": "integer" }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { + "cvss": { "items": { - "$ref": "#/$defs/domain_contact" + "$ref": "#/$defs/cvss" }, - "title": "Domain Contacts", + "title": "CVSS Score", "type": "array" }, - "email_addr": { - "title": "Registrar Abuse Email Address", + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" + }, + "cwe_uid": { + "title": "CWE UID", "type": "string" }, - "isp": { - "title": "ISP Name", + "cwe_url": { + "title": "CWE URL", "type": "string" }, - "isp_org": { - "title": "ISP Org", + "desc": { + "title": "Description", "type": "string" }, - "last_seen_time": { - "title": "Last Updated At", + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "name_servers": { + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "references": { "items": { "type": "string" }, - "title": "Name Servers", + "title": "References", "type": "array" }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" }, - "registrar": { - "title": "Domain Registrar", + "title": { + "title": "Title", "type": "string" }, - "status": { - "title": "Domain Status", + "type": { + "title": "Vulnerability Type", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", + "uid": { + "title": "CVE ID", "type": "string" } }, - "title": "WHOIS", + "required": [ + "uid" + ], + "title": "CVE", "type": "object" }, - "win_win_service": { + "domain_contact": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" }, - { - "required": [ - "service_category_id" - ] + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" }, - { - "required": [ - "service_dependencies" - ] + "name": { + "title": "Name", + "type": "string" }, - { - "required": [ - "service_error_control_id" - ] + "phone_number": { + "title": "Phone Number", + "type": "string" + }, + "type": { + "title": "Domain Contact Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" }, + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "type_id" + ], + "title": "Domain Contact", + "type": "object" + }, + "policy": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "service_start_name" + "name" ] }, { "required": [ - "service_start_type_id" + "type" ] }, { "required": [ - "service_type_id" + "uid" ] } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" + "data": { + "title": "Data" }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" + "desc": { + "title": "Description", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" + "is_applied": { + "title": "Applied", + "type": "boolean" }, "name": { "title": "Name", "type": "string" }, - "service_category": { - "title": "Service Category", + "type": { + "title": "Type", "type": "string" }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", + "uid": { + "title": "Unique ID", "type": "string" }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" + "end_time": { + "title": "End Time", + "type": "integer" }, - "service_start_name": { - "title": "Service Start Name", + "message": { + "title": "Message", "type": "string" }, - "service_start_type": { - "title": "Service Start Type", + "operation": { + "title": "Operation", "type": "string" }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "status_code": { + "title": "Status Code", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "name" + "end_time", + "start_time", + "uid" ], - "title": "Windows Service", + "title": "Span", "type": "object" } }, @@ -7897,68 +7897,99 @@ "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": false, "properties": { - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Activity ID", - "type": "integer" + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" }, - "activity_name": { - "title": "Activity", + "message": { + "title": "Message", "type": "string" }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" + }, + "category_uid": { + "const": 6, + "title": "Category ID", + "type": "integer" }, "api": { "$ref": "#/$defs/api", "title": "API Details" }, - "category_name": { - "title": "Category", + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "status_detail": { + "title": "Status Detail", "type": "string" }, - "category_uid": { - "const": 6, - "title": "Category ID", - "type": "integer" + "status_code": { + "title": "Status Code", + "type": "string" }, - "class_name": { - "title": "Class", + "type_name": { + "title": "Type Name", "type": "string" }, - "class_uid": { - "const": 6003, - "title": "Class ID", + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", "type": "integer" }, - "count": { - "title": "Count", + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", "type": "integer" }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "status": { + "title": "Status", + "type": "string" }, - "end_time": { - "title": "End Time", + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Activity ID", "type": "integer" }, + "resources": { + "items": { + "$ref": "#/$defs/resource_details" + }, + "title": "Resources Array", + "type": "array" + }, + "observables": { + "items": { + "$ref": "#/$defs/observable" + }, + "title": "Observables", + "type": "array" + }, "enrichments": { "items": { "$ref": "#/$defs/enrichment" @@ -7970,48 +8001,51 @@ "$ref": "#/$defs/http_request", "title": "HTTP Request" }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" }, - "message": { - "title": "Message", - "type": "string" + "class_uid": { + "const": 6003, + "title": "Class ID", + "type": "integer" }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" + "activity_name": { + "title": "Activity", + "type": "string" }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "raw_data": { - "title": "Raw Data", + "class_name": { + "title": "Class", "type": "string" }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" }, "raw_data_size": { "title": "Raw Data Size", "type": "integer" }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Resources Array", - "type": "array" + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, "severity": { "title": "Severity", "type": "string" }, + "category_name": { + "title": "Category", + "type": "string" + }, "severity_id": { "enum": [ 0, @@ -8026,59 +8060,25 @@ "title": "Severity ID", "type": "integer" }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", + "count": { + "title": "Count", "type": "integer" }, - "timezone_offset": { - "title": "Timezone Offset", + "end_time": { + "title": "End Time", "type": "integer" }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, "type_uid": { "title": "Type ID", "type": "integer" }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" + }, + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" } }, "required": [ diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/application_lifecycle@container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/application_lifecycle@container+host+trace.json deleted file mode 100644 index 3b41a46c79..0000000000 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/application_lifecycle@container+host+trace.json +++ /dev/null @@ -1,6945 +0,0 @@ -{ - "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for application_lifecycle. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", - "$defs": { - "account": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Advisory ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Advisory", - "type": "object" - }, - "affected_code": { - "additionalProperties": false, - "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" - }, - "start_column": { - "title": "Start Column", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "required": [ - "file" - ], - "title": "Affected Code", - "type": "object" - }, - "affected_package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "fixed_in_version": { - "title": "Fixed In Version", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", - "type": "object" - }, - "agent": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Agent Name", - "type": "string" - }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Agent ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate Agent ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Agent Version", - "type": "string" - } - }, - "title": "Agent", - "type": "object" - }, - "analytic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" - }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "operation" - ], - "title": "API", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" - }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "factor_type": { - "title": "Factor Type", - "type": "string" - }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" - }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" - }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - }, - "zone": { - "title": "Cloud Availability Zone", - "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Container", - "type": "object" - }, - "cve": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Vulnerability Type", - "type": "string" - }, - "uid": { - "title": "CVE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "vector_string": { - "title": "Vector String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "CWE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CWE", - "type": "object" - }, - "d3f_tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Technique", - "type": "object" - }, - "d3fend": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], - "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "category_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Category ID", - "type": "integer" - }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Data Classification", - "type": "object" - }, - "device": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "eid": { - "title": "EID", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", - "type": "string" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", - "type": "string" - }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "meid": { - "title": "MEID", - "type": "string" - }, - "model": { - "title": "Model", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "region": { - "title": "Region", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "subnet": { - "title": "Subnet", - "type": "string" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Device", - "type": "object" - }, - "device_hw_info": { - "additionalProperties": false, - "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" - }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", - "type": "string" - }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" - }, - "chassis": { - "title": "Chassis", - "type": "string" - }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" - }, - "cpu_architecture_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" - }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" - }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" - }, - "cpu_type": { - "title": "Processor Type", - "type": "string" - }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", - "type": "integer" - }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" - }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" - }, - "ram_size": { - "title": "RAM Size", - "type": "integer" - }, - "serial_number": { - "title": "Serial Number", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "developer_uid": { - "title": "Developer UID", - "type": "string" - }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" - }, - "type": { - "title": "Encryption Type", - "type": "string" - } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "score" - ], - "title": "EPSS", - "type": "object" - }, - "extension": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "drive_type": { - "title": "Drive Type", - "type": "string" - }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, - "name": { - "title": "Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "File", - "type": "object" - }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "condition": { - "title": "Condition", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "match_details": { - "items": { - "type": "string" - }, - "title": "Match Details", - "type": "array" - }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", - "type": "integer" - }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", - "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" - } - }, - "title": "GPU Information", - "type": "object" - }, - "group": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" - }, - "type": { - "title": "Group Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "KB Article", - "type": "object" - }, - "key_value_object": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "required": [ - "name" - ], - "title": "Key:Value object", - "type": "object" - }, - "keyboard_info": { - "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "office_location": { - "title": "Office Location", - "type": "string" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "surname": { - "title": "Surname", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" - }, - "city": { - "title": "City", - "type": "string" - }, - "continent": { - "title": "Continent", - "type": "string" - }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" - }, - "geohash": { - "title": "Geohash", - "type": "string" - }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" - }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" - }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", - "type": "object" - }, - "metadata": { - "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_source": { - "title": "Log Source", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", - "type": "string" - }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" - }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", - "type": "object" - }, - "observable": { - "additionalProperties": false, - "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", - "type": "string" - }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "title": "Occurrence Details", - "type": "object" - }, - "organization": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Package", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "title": "Process", - "type": "object" - }, - "process_entity": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "score": { - "title": "Reputation Score", - "type": "string" - }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", - "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", - "type": "string" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "span": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Time Span Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "account" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "forward_addr": { - "title": "Forwarding Address", - "type": "string" - }, - "full_name": { - "title": "Full Name", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] - }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" - }, - "exploit_type": { - "title": "Exploit Type", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Vulnerability Details", - "type": "object" - }, - "whois": { - "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" - } - }, - "title": "WHOIS", - "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" - ] - }, - { - "required": [ - "service_start_type_id" - ] - }, - { - "required": [ - "service_type_id" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "service_category": { - "title": "Service Category", - "type": "string" - }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", - "type": "string" - }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", - "type": "integer" - }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" - }, - "service_start_name": { - "title": "Service Start Name", - "type": "string" - }, - "service_start_type": { - "title": "Service Start Type", - "type": "string" - }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", - "type": "string" - }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Windows Service", - "type": "object" - } - }, - "$id": "https://schema.ocsf.io/schema/classes/application_lifecycle", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "properties": { - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Activity ID", - "type": "integer" - }, - "activity_name": { - "title": "Activity", - "type": "string" - }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "app": { - "$ref": "#/$defs/product", - "title": "Application" - }, - "category_name": { - "title": "Category", - "type": "string" - }, - "category_uid": { - "const": 6, - "title": "Category ID", - "type": "integer" - }, - "class_name": { - "title": "Class", - "type": "string" - }, - "class_uid": { - "const": 6002, - "title": "Class ID", - "type": "integer" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "enrichments": { - "items": { - "$ref": "#/$defs/enrichment" - }, - "title": "Enrichments", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" - }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "timezone_offset": { - "title": "Timezone Offset", - "type": "integer" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" - } - }, - "required": [ - "activity_id", - "app", - "category_uid", - "class_uid", - "metadata", - "severity_id", - "time", - "type_uid" - ], - "title": "Application Lifecycle", - "type": "object" -} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/authentication@host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/authentication@host+security_control+trace.json deleted file mode 100644 index 17a7abba54..0000000000 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/authentication@host+security_control+trace.json +++ /dev/null @@ -1,7807 +0,0 @@ -{ - "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for authentication. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", - "$defs": { - "account": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Advisory ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Advisory", - "type": "object" - }, - "affected_code": { - "additionalProperties": false, - "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" - }, - "start_column": { - "title": "Start Column", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "required": [ - "file" - ], - "title": "Affected Code", - "type": "object" - }, - "affected_package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "fixed_in_version": { - "title": "Fixed In Version", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", - "type": "object" - }, - "agent": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Agent Name", - "type": "string" - }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Agent ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate Agent ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Agent Version", - "type": "string" - } - }, - "title": "Agent", - "type": "object" - }, - "analytic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" - }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "operation" - ], - "title": "API", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" - }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "factor_type": { - "title": "Factor Type", - "type": "string" - }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" - }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authentication_token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "kerberos_flags": { - "title": "Kerberos Flags", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Authentication Token", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" - }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - }, - "zone": { - "title": "Cloud Availability Zone", - "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Container", - "type": "object" - }, - "cve": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Vulnerability Type", - "type": "string" - }, - "uid": { - "title": "CVE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "vector_string": { - "title": "Vector String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "CWE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CWE", - "type": "object" - }, - "d3f_tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Technique", - "type": "object" - }, - "d3fend": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], - "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "category_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Category ID", - "type": "integer" - }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Data Classification", - "type": "object" - }, - "device": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "eid": { - "title": "EID", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", - "type": "string" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", - "type": "string" - }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "meid": { - "title": "MEID", - "type": "string" - }, - "model": { - "title": "Model", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "region": { - "title": "Region", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "subnet": { - "title": "Subnet", - "type": "string" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Device", - "type": "object" - }, - "device_hw_info": { - "additionalProperties": false, - "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" - }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", - "type": "string" - }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" - }, - "chassis": { - "title": "Chassis", - "type": "string" - }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" - }, - "cpu_architecture_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" - }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" - }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" - }, - "cpu_type": { - "title": "Processor Type", - "type": "string" - }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", - "type": "integer" - }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" - }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" - }, - "ram_size": { - "title": "RAM Size", - "type": "integer" - }, - "serial_number": { - "title": "Serial Number", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "developer_uid": { - "title": "Developer UID", - "type": "string" - }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" - }, - "type": { - "title": "Encryption Type", - "type": "string" - } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "score" - ], - "title": "EPSS", - "type": "object" - }, - "extension": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "drive_type": { - "title": "Drive Type", - "type": "string" - }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, - "name": { - "title": "Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "File", - "type": "object" - }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "condition": { - "title": "Condition", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "match_details": { - "items": { - "type": "string" - }, - "title": "Match Details", - "type": "array" - }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", - "type": "integer" - }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", - "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" - } - }, - "title": "GPU Information", - "type": "object" - }, - "group": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" - }, - "type": { - "title": "Group Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "http_request": { - "additionalProperties": false, - "properties": { - "args": { - "title": "HTTP Arguments", - "type": "string" - }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", - "type": "string" - }, - "length": { - "title": "Request Length", - "type": "integer" - }, - "referrer": { - "title": "HTTP Referrer", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", - "type": "string" - }, - "version": { - "title": "HTTP Version", - "type": "string" - }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" - } - }, - "title": "HTTP Request", - "type": "object" - }, - "http_response": { - "additionalProperties": false, - "properties": { - "body_length": { - "title": "Response Body Length", - "type": "integer" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "content_type": { - "title": "HTTP Content Type", - "type": "string" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" - }, - "length": { - "title": "Response Length", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - } - }, - "required": [ - "code" - ], - "title": "HTTP Response", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "KB Article", - "type": "object" - }, - "key_value_object": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "required": [ - "name" - ], - "title": "Key:Value object", - "type": "object" - }, - "keyboard_info": { - "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "office_location": { - "title": "Office Location", - "type": "string" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "surname": { - "title": "Surname", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" - }, - "city": { - "title": "City", - "type": "string" - }, - "continent": { - "title": "Continent", - "type": "string" - }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" - }, - "geohash": { - "title": "Geohash", - "type": "string" - }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" - }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" - }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", - "type": "object" - }, - "metadata": { - "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_source": { - "title": "Log Source", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", - "type": "string" - }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_endpoint": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" - }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "network_proxy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", - "type": "object" - }, - "observable": { - "additionalProperties": false, - "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", - "type": "string" - }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "title": "Occurrence Details", - "type": "object" - }, - "organization": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Package", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "title": "Process", - "type": "object" - }, - "process_entity": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "score": { - "title": "Reputation Score", - "type": "string" - }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", - "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", - "type": "string" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "span": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Time Span Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "account" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "forward_addr": { - "title": "Forwarding Address", - "type": "string" - }, - "full_name": { - "title": "Full Name", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] - }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" - }, - "exploit_type": { - "title": "Exploit Type", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Vulnerability Details", - "type": "object" - }, - "whois": { - "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" - } - }, - "title": "WHOIS", - "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" - ] - }, - { - "required": [ - "service_start_type_id" - ] - }, - { - "required": [ - "service_type_id" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "service_category": { - "title": "Service Category", - "type": "string" - }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", - "type": "string" - }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", - "type": "integer" - }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" - }, - "service_start_name": { - "title": "Service Start Name", - "type": "string" - }, - "service_start_type": { - "title": "Service Start Type", - "type": "string" - }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", - "type": "string" - }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Windows Service", - "type": "object" - } - }, - "$id": "https://schema.ocsf.io/schema/classes/authentication", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "dst_endpoint" - ] - }, - { - "required": [ - "service" - ] - } - ], - "properties": { - "account_switch_type": { - "title": "Account Switch Type", - "type": "string" - }, - "account_switch_type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Account Switch Type ID", - "type": "integer" - }, - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" - }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Activity ID", - "type": "integer" - }, - "activity_name": { - "title": "Activity", - "type": "string" - }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "authentication_token": { - "$ref": "#/$defs/authentication_token", - "title": "Authentication Token" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "category_name": { - "title": "Category", - "type": "string" - }, - "category_uid": { - "const": 3, - "title": "Category ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "class_name": { - "title": "Class", - "type": "string" - }, - "class_uid": { - "const": 3002, - "title": "Class ID", - "type": "integer" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "confidence_score": { - "title": "Confidence Score", - "type": "integer" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "disposition": { - "title": "Disposition", - "type": "string" - }, - "disposition_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 99 - ], - "title": "Disposition ID", - "type": "integer" - }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "enrichments": { - "items": { - "$ref": "#/$defs/enrichment" - }, - "title": "Enrichments", - "type": "array" - }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "http_request": { - "$ref": "#/$defs/http_request", - "title": "HTTP Request" - }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" - }, - "is_alert": { - "title": "Alert", - "type": "boolean" - }, - "is_cleartext": { - "title": "Cleartext Credentials", - "type": "boolean" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_new_logon": { - "title": "New Logon", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "logon_process": { - "$ref": "#/$defs/process", - "title": "Logon Process" - }, - "logon_type": { - "title": "Logon Type", - "type": "string" - }, - "logon_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 99 - ], - "title": "Logon Type ID", - "type": "integer" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" - }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" - }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "timezone_offset": { - "title": "Timezone Offset", - "type": "integer" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "required": [ - "activity_id", - "category_uid", - "class_uid", - "metadata", - "severity_id", - "time", - "type_uid", - "user" - ], - "title": "Authentication", - "type": "object" -} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/base_event@container+host+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/base_event@container+host+trace.json deleted file mode 100644 index 234e1bf377..0000000000 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/base_event@container+host+trace.json +++ /dev/null @@ -1,6932 +0,0 @@ -{ - "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for base_event. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", - "$defs": { - "account": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Advisory ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Advisory", - "type": "object" - }, - "affected_code": { - "additionalProperties": false, - "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" - }, - "start_column": { - "title": "Start Column", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "required": [ - "file" - ], - "title": "Affected Code", - "type": "object" - }, - "affected_package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "fixed_in_version": { - "title": "Fixed In Version", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", - "type": "object" - }, - "agent": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Agent Name", - "type": "string" - }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Agent ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate Agent ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Agent Version", - "type": "string" - } - }, - "title": "Agent", - "type": "object" - }, - "analytic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" - }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "operation" - ], - "title": "API", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" - }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "factor_type": { - "title": "Factor Type", - "type": "string" - }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" - }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" - }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - }, - "zone": { - "title": "Cloud Availability Zone", - "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Container", - "type": "object" - }, - "cve": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Vulnerability Type", - "type": "string" - }, - "uid": { - "title": "CVE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "vector_string": { - "title": "Vector String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "CWE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CWE", - "type": "object" - }, - "d3f_tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Technique", - "type": "object" - }, - "d3fend": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], - "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "category_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Category ID", - "type": "integer" - }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Data Classification", - "type": "object" - }, - "device": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "eid": { - "title": "EID", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", - "type": "string" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", - "type": "string" - }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "meid": { - "title": "MEID", - "type": "string" - }, - "model": { - "title": "Model", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "region": { - "title": "Region", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "subnet": { - "title": "Subnet", - "type": "string" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Device", - "type": "object" - }, - "device_hw_info": { - "additionalProperties": false, - "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" - }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", - "type": "string" - }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" - }, - "chassis": { - "title": "Chassis", - "type": "string" - }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" - }, - "cpu_architecture_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" - }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" - }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" - }, - "cpu_type": { - "title": "Processor Type", - "type": "string" - }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", - "type": "integer" - }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" - }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" - }, - "ram_size": { - "title": "RAM Size", - "type": "integer" - }, - "serial_number": { - "title": "Serial Number", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "developer_uid": { - "title": "Developer UID", - "type": "string" - }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" - }, - "type": { - "title": "Encryption Type", - "type": "string" - } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "score" - ], - "title": "EPSS", - "type": "object" - }, - "extension": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "drive_type": { - "title": "Drive Type", - "type": "string" - }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, - "name": { - "title": "Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "File", - "type": "object" - }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "condition": { - "title": "Condition", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "match_details": { - "items": { - "type": "string" - }, - "title": "Match Details", - "type": "array" - }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", - "type": "integer" - }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", - "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" - } - }, - "title": "GPU Information", - "type": "object" - }, - "group": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" - }, - "type": { - "title": "Group Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "KB Article", - "type": "object" - }, - "key_value_object": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "required": [ - "name" - ], - "title": "Key:Value object", - "type": "object" - }, - "keyboard_info": { - "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "office_location": { - "title": "Office Location", - "type": "string" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "surname": { - "title": "Surname", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" - }, - "city": { - "title": "City", - "type": "string" - }, - "continent": { - "title": "Continent", - "type": "string" - }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" - }, - "geohash": { - "title": "Geohash", - "type": "string" - }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" - }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" - }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", - "type": "object" - }, - "metadata": { - "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_source": { - "title": "Log Source", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", - "type": "string" - }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" - }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", - "type": "object" - }, - "observable": { - "additionalProperties": false, - "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", - "type": "string" - }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "title": "Occurrence Details", - "type": "object" - }, - "organization": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Package", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "title": "Process", - "type": "object" - }, - "process_entity": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "score": { - "title": "Reputation Score", - "type": "string" - }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", - "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", - "type": "string" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "span": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Time Span Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "account" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "forward_addr": { - "title": "Forwarding Address", - "type": "string" - }, - "full_name": { - "title": "Full Name", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] - }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" - }, - "exploit_type": { - "title": "Exploit Type", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Vulnerability Details", - "type": "object" - }, - "whois": { - "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" - } - }, - "title": "WHOIS", - "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" - ] - }, - { - "required": [ - "service_start_type_id" - ] - }, - { - "required": [ - "service_type_id" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "service_category": { - "title": "Service Category", - "type": "string" - }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", - "type": "string" - }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", - "type": "integer" - }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" - }, - "service_start_name": { - "title": "Service Start Name", - "type": "string" - }, - "service_start_type": { - "title": "Service Start Type", - "type": "string" - }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", - "type": "string" - }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Windows Service", - "type": "object" - } - }, - "$id": "https://schema.ocsf.io/schema/classes/base_event", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "properties": { - "activity_id": { - "enum": [ - 0, - 99 - ], - "title": "Activity ID", - "type": "integer" - }, - "activity_name": { - "title": "Activity", - "type": "string" - }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "category_name": { - "title": "Category", - "type": "string" - }, - "category_uid": { - "const": 0, - "title": "Category ID", - "type": "integer" - }, - "class_name": { - "title": "Class", - "type": "string" - }, - "class_uid": { - "const": 0, - "title": "Class ID", - "type": "integer" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "enrichments": { - "items": { - "$ref": "#/$defs/enrichment" - }, - "title": "Enrichments", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" - }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "timezone_offset": { - "title": "Timezone Offset", - "type": "integer" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" - } - }, - "required": [ - "activity_id", - "category_uid", - "class_uid", - "metadata", - "severity_id", - "time", - "type_uid" - ], - "title": "Base Event", - "type": "object" -} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@container+host+security_control+trace.json deleted file mode 100644 index 230c0c8b74..0000000000 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@container+host+security_control+trace.json +++ /dev/null @@ -1,9438 +0,0 @@ -{ - "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for detection_finding. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", - "$defs": { - "account": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Advisory ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Advisory", - "type": "object" - }, - "affected_code": { - "additionalProperties": false, - "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" - }, - "start_column": { - "title": "Start Column", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "required": [ - "file" - ], - "title": "Affected Code", - "type": "object" - }, - "affected_package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "fixed_in_version": { - "title": "Fixed In Version", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", - "type": "object" - }, - "agent": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Agent Name", - "type": "string" - }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Agent ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate Agent ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Agent Version", - "type": "string" - } - }, - "title": "Agent", - "type": "object" - }, - "analysis_target": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Analysis Target", - "type": "object" - }, - "analytic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "anomaly": { - "additionalProperties": false, - "properties": { - "observation_parameter": { - "title": "Observation Parameter", - "type": "string" - }, - "observation_type": { - "title": "Observation Type", - "type": "string" - }, - "observations": { - "items": { - "$ref": "#/$defs/observation" - }, - "title": "Observations", - "type": "array" - }, - "observed_pattern": { - "title": "Observed Pattern", - "type": "string" - } - }, - "required": [ - "observation_parameter", - "observations" - ], - "title": "Anomaly", - "type": "object" - }, - "anomaly_analysis": { - "additionalProperties": false, - "properties": { - "analysis_targets": { - "items": { - "$ref": "#/$defs/analysis_target" - }, - "title": "Analysis Targets", - "type": "array" - }, - "anomalies": { - "items": { - "$ref": "#/$defs/anomaly" - }, - "title": "Anomalies", - "type": "array" - }, - "baselines": { - "items": { - "$ref": "#/$defs/baseline" - }, - "title": "Baselines", - "type": "array" - } - }, - "required": [ - "analysis_targets", - "anomalies" - ], - "title": "Anomaly Analysis", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" - }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "operation" - ], - "title": "API", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" - }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "factor_type": { - "title": "Factor Type", - "type": "string" - }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" - }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "baseline": { - "additionalProperties": false, - "properties": { - "observation_parameter": { - "title": "Observation Parameter", - "type": "string" - }, - "observation_type": { - "title": "Observation Type", - "type": "string" - }, - "observations": { - "items": { - "$ref": "#/$defs/observation" - }, - "title": "Observations", - "type": "array" - }, - "observed_pattern": { - "title": "Observed Pattern", - "type": "string" - } - }, - "required": [ - "observation_parameter", - "observations" - ], - "title": "Baseline", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" - }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - }, - "zone": { - "title": "Cloud Availability Zone", - "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Container", - "type": "object" - }, - "cve": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Vulnerability Type", - "type": "string" - }, - "uid": { - "title": "CVE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "vector_string": { - "title": "Vector String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "CWE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CWE", - "type": "object" - }, - "d3f_tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Technique", - "type": "object" - }, - "d3fend": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], - "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "category_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Category ID", - "type": "integer" - }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Data Classification", - "type": "object" - }, - "database": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "embedding_model": { - "title": "Embedding Model", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Database", - "type": "object" - }, - "databucket": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "criticality": { - "title": "Criticality", - "type": "string" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_public": { - "title": "Public", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Databucket", - "type": "object" - }, - "device": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "eid": { - "title": "EID", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", - "type": "string" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", - "type": "string" - }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "meid": { - "title": "MEID", - "type": "string" - }, - "model": { - "title": "Model", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "region": { - "title": "Region", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "subnet": { - "title": "Subnet", - "type": "string" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Device", - "type": "object" - }, - "device_hw_info": { - "additionalProperties": false, - "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" - }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", - "type": "string" - }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" - }, - "chassis": { - "title": "Chassis", - "type": "string" - }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" - }, - "cpu_architecture_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" - }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" - }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" - }, - "cpu_type": { - "title": "Processor Type", - "type": "string" - }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", - "type": "integer" - }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" - }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" - }, - "ram_size": { - "title": "RAM Size", - "type": "integer" - }, - "serial_number": { - "title": "Serial Number", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "developer_uid": { - "title": "Developer UID", - "type": "string" - }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "dns_query": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "opcode": { - "title": "DNS Opcode", - "type": "string" - }, - "opcode_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "DNS Opcode ID", - "type": "integer" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "hostname" - ], - "title": "DNS Query", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "edge": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "relation": { - "title": "Relation", - "type": "string" - }, - "source": { - "title": "Source", - "type": "string" - }, - "target": { - "title": "Target", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "source", - "target" - ], - "title": "Edge", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" - }, - "type": { - "title": "Encryption Type", - "type": "string" - } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "score" - ], - "title": "EPSS", - "type": "object" - }, - "evidences": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "actor" - ] - }, - { - "required": [ - "api" - ] - }, - { - "required": [ - "connection_info" - ] - }, - { - "required": [ - "data" - ] - }, - { - "required": [ - "database" - ] - }, - { - "required": [ - "databucket" - ] - }, - { - "required": [ - "device" - ] - }, - { - "required": [ - "dst_endpoint" - ] - }, - { - "required": [ - "email" - ] - }, - { - "required": [ - "file" - ] - }, - { - "required": [ - "job" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "query" - ] - }, - { - "required": [ - "reg_key" - ] - }, - { - "required": [ - "reg_value" - ] - }, - { - "required": [ - "script" - ] - }, - { - "required": [ - "src_endpoint" - ] - }, - { - "required": [ - "url" - ] - }, - { - "required": [ - "user" - ] - }, - { - "required": [ - "win_service" - ] - } - ], - "properties": { - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "api": { - "$ref": "#/$defs/api", - "title": "API Details" - }, - "connection_info": { - "$ref": "#/$defs/network_connection_info", - "title": "Connection Info" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "data": { - "title": "Data" - }, - "database": { - "$ref": "#/$defs/database", - "title": "Database" - }, - "databucket": { - "$ref": "#/$defs/databucket", - "title": "Databucket" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Email" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "http_request": { - "$ref": "#/$defs/http_request", - "title": "HTTP Request" - }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" - }, - "ja4_fingerprint_list": { - "items": { - "$ref": "#/$defs/ja4_fingerprint" - }, - "title": "JA4+ Fingerprints", - "type": "array" - }, - "job": { - "$ref": "#/$defs/job", - "title": "Job" - }, - "name": { - "title": "Name", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "query": { - "$ref": "#/$defs/dns_query", - "title": "DNS Query" - }, - "reg_key": { - "$ref": "#/$defs/win_reg_key", - "title": "Registry Key" - }, - "reg_value": { - "$ref": "#/$defs/win_reg_value", - "title": "Registry Value" - }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Cloud Resources", - "type": "array" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Script" - }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "tls": { - "$ref": "#/$defs/tls", - "title": "TLS" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "verdict": { - "title": "Verdict", - "type": "string" - }, - "verdict_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Verdict ID", - "type": "integer" - }, - "win_service": { - "$ref": "#/$defs/win_win_service", - "title": "Windows Service" - } - }, - "title": "Evidence Artifacts", - "type": "object" - }, - "extension": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "drive_type": { - "title": "Drive Type", - "type": "string" - }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, - "name": { - "title": "Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "File", - "type": "object" - }, - "finding_info": { - "additionalProperties": false, - "properties": { - "analytic": { - "$ref": "#/$defs/analytic", - "title": "Analytic" - }, - "attack_graph": { - "$ref": "#/$defs/graph", - "title": "Attack Graph" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data_sources": { - "items": { - "type": "string" - }, - "title": "Data Sources", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "product_uid": { - "title": "Product Identifier", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "related_events": { - "items": { - "$ref": "#/$defs/related_event" - }, - "title": "Related Events/Findings", - "type": "array" - }, - "related_events_count": { - "title": "Related Events/Findings Count", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "traits": { - "items": { - "$ref": "#/$defs/trait" - }, - "title": "Traits", - "type": "array" - }, - "types": { - "items": { - "type": "string" - }, - "title": "Types", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Finding Information", - "type": "object" - }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "condition": { - "title": "Condition", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "match_details": { - "items": { - "type": "string" - }, - "title": "Match Details", - "type": "array" - }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", - "type": "integer" - }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", - "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" - } - }, - "title": "GPU Information", - "type": "object" - }, - "graph": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "edges": { - "items": { - "$ref": "#/$defs/edge" - }, - "title": "Edges", - "type": "array" - }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" - }, - "query_language": { - "title": "Query Language", - "type": "string" - }, - "query_language_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Query Language ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "nodes" - ], - "title": "Graph", - "type": "object" - }, - "group": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" - }, - "type": { - "title": "Group Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "http_request": { - "additionalProperties": false, - "properties": { - "args": { - "title": "HTTP Arguments", - "type": "string" - }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", - "type": "string" - }, - "length": { - "title": "Request Length", - "type": "integer" - }, - "referrer": { - "title": "HTTP Referrer", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", - "type": "string" - }, - "version": { - "title": "HTTP Version", - "type": "string" - }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" - } - }, - "title": "HTTP Request", - "type": "object" - }, - "http_response": { - "additionalProperties": false, - "properties": { - "body_length": { - "title": "Response Body Length", - "type": "integer" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "content_type": { - "title": "HTTP Content Type", - "type": "string" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" - }, - "length": { - "title": "Response Length", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - } - }, - "required": [ - "code" - ], - "title": "HTTP Response", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "ja4_fingerprint": { - "additionalProperties": false, - "properties": { - "section_a": { - "title": "JA4 Section A", - "type": "string" - }, - "section_b": { - "title": "JA4 Section B", - "type": "string" - }, - "section_c": { - "title": "JA4 Section C", - "type": "string" - }, - "section_d": { - "title": "JA4 Section D", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "JA4+ Fingerprint", - "type": "object" - }, - "job": { - "additionalProperties": false, - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "last_run_time": { - "title": "Last Run", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "next_run_time": { - "title": "Next Run", - "type": "integer" - }, - "run_state": { - "title": "Run State", - "type": "string" - }, - "run_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Run State ID", - "type": "integer" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "required": [ - "name" - ], - "title": "Job", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "KB Article", - "type": "object" - }, - "key_value_object": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "required": [ - "name" - ], - "title": "Key:Value object", - "type": "object" - }, - "keyboard_info": { - "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "office_location": { - "title": "Office Location", - "type": "string" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "surname": { - "title": "Surname", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" - }, - "city": { - "title": "City", - "type": "string" - }, - "continent": { - "title": "Continent", - "type": "string" - }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" - }, - "geohash": { - "title": "Geohash", - "type": "string" - }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" - }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" - }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", - "type": "object" - }, - "metadata": { - "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_source": { - "title": "Log Source", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", - "type": "string" - }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_connection_info": { - "additionalProperties": false, - "properties": { - "boundary": { - "title": "Boundary", - "type": "string" - }, - "boundary_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Boundary ID", - "type": "integer" - }, - "community_uid": { - "title": "Community ID", - "type": "string" - }, - "direction": { - "title": "Direction", - "type": "string" - }, - "direction_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Direction ID", - "type": "integer" - }, - "flag_history": { - "title": "Connection Flag History", - "type": "string" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - }, - "protocol_ver": { - "title": "IP Version", - "type": "string" - }, - "protocol_ver_id": { - "enum": [ - 0, - 4, - 6, - 99 - ], - "title": "IP Version ID", - "type": "integer" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "tcp_flags": { - "title": "TCP Flags", - "type": "integer" - }, - "uid": { - "title": "Connection UID", - "type": "string" - } - }, - "required": [ - "direction_id" - ], - "title": "Network Connection Information", - "type": "object" - }, - "network_endpoint": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" - }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "network_proxy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "node": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", - "type": "object" - }, - "observable": { - "additionalProperties": false, - "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "observation": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "timespan": { - "$ref": "#/$defs/timespan", - "title": "Time Span" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Observation", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", - "type": "string" - }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "title": "Occurrence Details", - "type": "object" - }, - "organization": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Package", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "title": "Process", - "type": "object" - }, - "process_entity": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "related_event": { - "additionalProperties": false, - "properties": { - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "product_uid": { - "title": "Product Identifier", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "traits": { - "items": { - "$ref": "#/$defs/trait" - }, - "title": "Traits", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Related Event/Finding", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "score": { - "title": "Reputation Score", - "type": "string" - }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", - "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "resource_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "criticality": { - "title": "Criticality", - "type": "string" - }, - "data": { - "title": "Data" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" - }, - "role": { - "title": "Role", - "type": "string" - }, - "role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Role ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Resource Details", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", - "type": "string" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "span": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "ticket": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Ticket Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Ticket Status ID", - "type": "integer" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Ticket Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Ticket Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Ticket", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Time Span Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "tls": { - "additionalProperties": false, - "properties": { - "alert": { - "title": "Client TLS Alert", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "certificate_chain": { - "items": { - "type": "string" - }, - "title": "Certificate Chain", - "type": "array" - }, - "cipher": { - "title": "Cipher Suite", - "type": "string" - }, - "client_ciphers": { - "items": { - "type": "string" - }, - "title": "Client Cipher Suites", - "type": "array" - }, - "extension_list": { - "items": { - "$ref": "#/$defs/tls_extension" - }, - "title": "Extension List", - "type": "array" - }, - "handshake_dur": { - "title": "Handshake Duration", - "type": "integer" - }, - "ja3_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3 Hash" - }, - "ja3s_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3S Hash" - }, - "key_length": { - "title": "Key Length", - "type": "integer" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "server_ciphers": { - "items": { - "type": "string" - }, - "title": "Server Cipher Suites", - "type": "array" - }, - "sni": { - "title": "Server Name Indication", - "type": "string" - }, - "tls_extension_list": { - "items": { - "$ref": "#/$defs/tls_extension" - }, - "title": "TLS Extension List", - "type": "array" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Transport Layer Security (TLS)", - "type": "object" - }, - "tls_extension": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 5, - 10, - 13, - 14, - 15, - 16, - 18, - 19, - 20, - 21, - 41, - 42, - 43, - 44, - 45, - 47, - 48, - 49, - 50, - 51, - 99 - ], - "title": "Type ID", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "TLS Extension", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "trait": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "title": "Trait", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "account" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "forward_addr": { - "title": "Forwarding Address", - "type": "string" - }, - "full_name": { - "title": "Full Name", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vendor_attributes": { - "additionalProperties": false, - "properties": { - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - } - }, - "title": "Vendor Attributes", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] - }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" - }, - "exploit_type": { - "title": "Exploit Type", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Vulnerability Details", - "type": "object" - }, - "whois": { - "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" - } - }, - "title": "WHOIS", - "type": "object" - }, - "win_reg_key": { - "additionalProperties": false, - "properties": { - "is_system": { - "title": "System", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - } - }, - "required": [ - "path" - ], - "title": "Registry Key", - "type": "object" - }, - "win_reg_value": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" - }, - "is_default": { - "title": "Default Value", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "reg_binary_data": { - "title": "Registry Binary Data", - "type": "string" - }, - "reg_integer_data": { - "title": "Registry Integer Data", - "type": "integer" - }, - "reg_string_data": { - "title": "Registry String Data", - "type": "string" - }, - "reg_string_list_data": { - "items": { - "type": "string" - }, - "title": "Registry String List Data", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Type ID", - "type": "integer" - } - }, - "required": [ - "name", - "path" - ], - "title": "Registry Value", - "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" - ] - }, - { - "required": [ - "service_start_type_id" - ] - }, - { - "required": [ - "service_type_id" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "service_category": { - "title": "Service Category", - "type": "string" - }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", - "type": "string" - }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", - "type": "integer" - }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" - }, - "service_start_name": { - "title": "Service Start Name", - "type": "string" - }, - "service_start_type": { - "title": "Service Start Type", - "type": "string" - }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", - "type": "string" - }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Windows Service", - "type": "object" - } - }, - "$id": "https://schema.ocsf.io/schema/classes/detection_finding", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "properties": { - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" - }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Activity ID", - "type": "integer" - }, - "activity_name": { - "title": "Activity", - "type": "string" - }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "anomaly_analyses": { - "items": { - "$ref": "#/$defs/anomaly_analysis" - }, - "title": "Anomaly Analyses", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "category_name": { - "title": "Category", - "type": "string" - }, - "category_uid": { - "const": 2, - "title": "Category ID", - "type": "integer" - }, - "class_name": { - "title": "Class", - "type": "string" - }, - "class_uid": { - "const": 2004, - "title": "Class ID", - "type": "integer" - }, - "comment": { - "title": "Comment", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "confidence_score": { - "title": "Confidence Score", - "type": "integer" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "disposition": { - "title": "Disposition", - "type": "string" - }, - "disposition_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 99 - ], - "title": "Disposition ID", - "type": "integer" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "enrichments": { - "items": { - "$ref": "#/$defs/enrichment" - }, - "title": "Enrichments", - "type": "array" - }, - "evidences": { - "items": { - "$ref": "#/$defs/evidences" - }, - "title": "Evidence Artifacts", - "type": "array" - }, - "finding_info": { - "$ref": "#/$defs/finding_info", - "title": "Finding Information" - }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "impact": { - "title": "Impact", - "type": "string" - }, - "impact_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Impact ID", - "type": "integer" - }, - "impact_score": { - "title": "Impact Score", - "type": "integer" - }, - "is_alert": { - "title": "Alert", - "type": "boolean" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" - }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Affected Resources", - "type": "array" - }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "timezone_offset": { - "title": "Timezone Offset", - "type": "integer" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" - }, - "vendor_attributes": { - "$ref": "#/$defs/vendor_attributes", - "title": "Vendor Attributes" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Vulnerabilities", - "type": "array" - } - }, - "required": [ - "activity_id", - "category_uid", - "class_uid", - "finding_info", - "metadata", - "severity_id", - "time", - "type_uid" - ], - "title": "Detection Finding", - "type": "object" -} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@host+security_control+trace.json deleted file mode 100644 index 28b22c07fc..0000000000 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/detection_finding@host+security_control+trace.json +++ /dev/null @@ -1,9406 +0,0 @@ -{ - "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for detection_finding. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", - "$defs": { - "account": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Advisory ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Advisory", - "type": "object" - }, - "affected_code": { - "additionalProperties": false, - "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" - }, - "start_column": { - "title": "Start Column", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "required": [ - "file" - ], - "title": "Affected Code", - "type": "object" - }, - "affected_package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "fixed_in_version": { - "title": "Fixed In Version", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", - "type": "object" - }, - "agent": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Agent Name", - "type": "string" - }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Agent ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate Agent ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Agent Version", - "type": "string" - } - }, - "title": "Agent", - "type": "object" - }, - "analysis_target": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Analysis Target", - "type": "object" - }, - "analytic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "anomaly": { - "additionalProperties": false, - "properties": { - "observation_parameter": { - "title": "Observation Parameter", - "type": "string" - }, - "observation_type": { - "title": "Observation Type", - "type": "string" - }, - "observations": { - "items": { - "$ref": "#/$defs/observation" - }, - "title": "Observations", - "type": "array" - }, - "observed_pattern": { - "title": "Observed Pattern", - "type": "string" - } - }, - "required": [ - "observation_parameter", - "observations" - ], - "title": "Anomaly", - "type": "object" - }, - "anomaly_analysis": { - "additionalProperties": false, - "properties": { - "analysis_targets": { - "items": { - "$ref": "#/$defs/analysis_target" - }, - "title": "Analysis Targets", - "type": "array" - }, - "anomalies": { - "items": { - "$ref": "#/$defs/anomaly" - }, - "title": "Anomalies", - "type": "array" - }, - "baselines": { - "items": { - "$ref": "#/$defs/baseline" - }, - "title": "Baselines", - "type": "array" - } - }, - "required": [ - "analysis_targets", - "anomalies" - ], - "title": "Anomaly Analysis", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" - }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "operation" - ], - "title": "API", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" - }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "factor_type": { - "title": "Factor Type", - "type": "string" - }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" - }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "baseline": { - "additionalProperties": false, - "properties": { - "observation_parameter": { - "title": "Observation Parameter", - "type": "string" - }, - "observation_type": { - "title": "Observation Type", - "type": "string" - }, - "observations": { - "items": { - "$ref": "#/$defs/observation" - }, - "title": "Observations", - "type": "array" - }, - "observed_pattern": { - "title": "Observed Pattern", - "type": "string" - } - }, - "required": [ - "observation_parameter", - "observations" - ], - "title": "Baseline", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" - }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - }, - "zone": { - "title": "Cloud Availability Zone", - "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Container", - "type": "object" - }, - "cve": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Vulnerability Type", - "type": "string" - }, - "uid": { - "title": "CVE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "vector_string": { - "title": "Vector String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "CWE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CWE", - "type": "object" - }, - "d3f_tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Technique", - "type": "object" - }, - "d3fend": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], - "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "category_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Category ID", - "type": "integer" - }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Data Classification", - "type": "object" - }, - "database": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "embedding_model": { - "title": "Embedding Model", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Database", - "type": "object" - }, - "databucket": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "criticality": { - "title": "Criticality", - "type": "string" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_public": { - "title": "Public", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Databucket", - "type": "object" - }, - "device": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "eid": { - "title": "EID", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", - "type": "string" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", - "type": "string" - }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "meid": { - "title": "MEID", - "type": "string" - }, - "model": { - "title": "Model", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "region": { - "title": "Region", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "subnet": { - "title": "Subnet", - "type": "string" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Device", - "type": "object" - }, - "device_hw_info": { - "additionalProperties": false, - "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" - }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", - "type": "string" - }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" - }, - "chassis": { - "title": "Chassis", - "type": "string" - }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" - }, - "cpu_architecture_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" - }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" - }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" - }, - "cpu_type": { - "title": "Processor Type", - "type": "string" - }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", - "type": "integer" - }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" - }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" - }, - "ram_size": { - "title": "RAM Size", - "type": "integer" - }, - "serial_number": { - "title": "Serial Number", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "developer_uid": { - "title": "Developer UID", - "type": "string" - }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "dns_query": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "opcode": { - "title": "DNS Opcode", - "type": "string" - }, - "opcode_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "DNS Opcode ID", - "type": "integer" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "hostname" - ], - "title": "DNS Query", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "edge": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "relation": { - "title": "Relation", - "type": "string" - }, - "source": { - "title": "Source", - "type": "string" - }, - "target": { - "title": "Target", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "source", - "target" - ], - "title": "Edge", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" - }, - "type": { - "title": "Encryption Type", - "type": "string" - } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "score" - ], - "title": "EPSS", - "type": "object" - }, - "evidences": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "actor" - ] - }, - { - "required": [ - "api" - ] - }, - { - "required": [ - "connection_info" - ] - }, - { - "required": [ - "data" - ] - }, - { - "required": [ - "database" - ] - }, - { - "required": [ - "databucket" - ] - }, - { - "required": [ - "device" - ] - }, - { - "required": [ - "dst_endpoint" - ] - }, - { - "required": [ - "email" - ] - }, - { - "required": [ - "file" - ] - }, - { - "required": [ - "job" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "query" - ] - }, - { - "required": [ - "reg_key" - ] - }, - { - "required": [ - "reg_value" - ] - }, - { - "required": [ - "script" - ] - }, - { - "required": [ - "src_endpoint" - ] - }, - { - "required": [ - "url" - ] - }, - { - "required": [ - "user" - ] - }, - { - "required": [ - "win_service" - ] - } - ], - "properties": { - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "api": { - "$ref": "#/$defs/api", - "title": "API Details" - }, - "connection_info": { - "$ref": "#/$defs/network_connection_info", - "title": "Connection Info" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "data": { - "title": "Data" - }, - "database": { - "$ref": "#/$defs/database", - "title": "Database" - }, - "databucket": { - "$ref": "#/$defs/databucket", - "title": "Databucket" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Email" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "http_request": { - "$ref": "#/$defs/http_request", - "title": "HTTP Request" - }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" - }, - "ja4_fingerprint_list": { - "items": { - "$ref": "#/$defs/ja4_fingerprint" - }, - "title": "JA4+ Fingerprints", - "type": "array" - }, - "job": { - "$ref": "#/$defs/job", - "title": "Job" - }, - "name": { - "title": "Name", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "query": { - "$ref": "#/$defs/dns_query", - "title": "DNS Query" - }, - "reg_key": { - "$ref": "#/$defs/win_reg_key", - "title": "Registry Key" - }, - "reg_value": { - "$ref": "#/$defs/win_reg_value", - "title": "Registry Value" - }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Cloud Resources", - "type": "array" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Script" - }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "tls": { - "$ref": "#/$defs/tls", - "title": "TLS" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "verdict": { - "title": "Verdict", - "type": "string" - }, - "verdict_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Verdict ID", - "type": "integer" - }, - "win_service": { - "$ref": "#/$defs/win_win_service", - "title": "Windows Service" - } - }, - "title": "Evidence Artifacts", - "type": "object" - }, - "extension": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "drive_type": { - "title": "Drive Type", - "type": "string" - }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, - "name": { - "title": "Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "File", - "type": "object" - }, - "finding_info": { - "additionalProperties": false, - "properties": { - "analytic": { - "$ref": "#/$defs/analytic", - "title": "Analytic" - }, - "attack_graph": { - "$ref": "#/$defs/graph", - "title": "Attack Graph" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data_sources": { - "items": { - "type": "string" - }, - "title": "Data Sources", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "product_uid": { - "title": "Product Identifier", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "related_events": { - "items": { - "$ref": "#/$defs/related_event" - }, - "title": "Related Events/Findings", - "type": "array" - }, - "related_events_count": { - "title": "Related Events/Findings Count", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "traits": { - "items": { - "$ref": "#/$defs/trait" - }, - "title": "Traits", - "type": "array" - }, - "types": { - "items": { - "type": "string" - }, - "title": "Types", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Finding Information", - "type": "object" - }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "condition": { - "title": "Condition", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "match_details": { - "items": { - "type": "string" - }, - "title": "Match Details", - "type": "array" - }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", - "type": "integer" - }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", - "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" - } - }, - "title": "GPU Information", - "type": "object" - }, - "graph": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "edges": { - "items": { - "$ref": "#/$defs/edge" - }, - "title": "Edges", - "type": "array" - }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" - }, - "query_language": { - "title": "Query Language", - "type": "string" - }, - "query_language_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Query Language ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "nodes" - ], - "title": "Graph", - "type": "object" - }, - "group": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" - }, - "type": { - "title": "Group Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "http_request": { - "additionalProperties": false, - "properties": { - "args": { - "title": "HTTP Arguments", - "type": "string" - }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", - "type": "string" - }, - "length": { - "title": "Request Length", - "type": "integer" - }, - "referrer": { - "title": "HTTP Referrer", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", - "type": "string" - }, - "version": { - "title": "HTTP Version", - "type": "string" - }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" - } - }, - "title": "HTTP Request", - "type": "object" - }, - "http_response": { - "additionalProperties": false, - "properties": { - "body_length": { - "title": "Response Body Length", - "type": "integer" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "content_type": { - "title": "HTTP Content Type", - "type": "string" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" - }, - "length": { - "title": "Response Length", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - } - }, - "required": [ - "code" - ], - "title": "HTTP Response", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "ja4_fingerprint": { - "additionalProperties": false, - "properties": { - "section_a": { - "title": "JA4 Section A", - "type": "string" - }, - "section_b": { - "title": "JA4 Section B", - "type": "string" - }, - "section_c": { - "title": "JA4 Section C", - "type": "string" - }, - "section_d": { - "title": "JA4 Section D", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "JA4+ Fingerprint", - "type": "object" - }, - "job": { - "additionalProperties": false, - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "last_run_time": { - "title": "Last Run", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "next_run_time": { - "title": "Next Run", - "type": "integer" - }, - "run_state": { - "title": "Run State", - "type": "string" - }, - "run_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Run State ID", - "type": "integer" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "required": [ - "name" - ], - "title": "Job", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "KB Article", - "type": "object" - }, - "key_value_object": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "required": [ - "name" - ], - "title": "Key:Value object", - "type": "object" - }, - "keyboard_info": { - "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "office_location": { - "title": "Office Location", - "type": "string" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "surname": { - "title": "Surname", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" - }, - "city": { - "title": "City", - "type": "string" - }, - "continent": { - "title": "Continent", - "type": "string" - }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" - }, - "geohash": { - "title": "Geohash", - "type": "string" - }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" - }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" - }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", - "type": "object" - }, - "metadata": { - "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_source": { - "title": "Log Source", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", - "type": "string" - }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_connection_info": { - "additionalProperties": false, - "properties": { - "boundary": { - "title": "Boundary", - "type": "string" - }, - "boundary_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Boundary ID", - "type": "integer" - }, - "community_uid": { - "title": "Community ID", - "type": "string" - }, - "direction": { - "title": "Direction", - "type": "string" - }, - "direction_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Direction ID", - "type": "integer" - }, - "flag_history": { - "title": "Connection Flag History", - "type": "string" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - }, - "protocol_ver": { - "title": "IP Version", - "type": "string" - }, - "protocol_ver_id": { - "enum": [ - 0, - 4, - 6, - 99 - ], - "title": "IP Version ID", - "type": "integer" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "tcp_flags": { - "title": "TCP Flags", - "type": "integer" - }, - "uid": { - "title": "Connection UID", - "type": "string" - } - }, - "required": [ - "direction_id" - ], - "title": "Network Connection Information", - "type": "object" - }, - "network_endpoint": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" - }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "network_proxy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "node": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", - "type": "object" - }, - "observable": { - "additionalProperties": false, - "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "observation": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "timespan": { - "$ref": "#/$defs/timespan", - "title": "Time Span" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Observation", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", - "type": "string" - }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "title": "Occurrence Details", - "type": "object" - }, - "organization": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Package", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "title": "Process", - "type": "object" - }, - "process_entity": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "related_event": { - "additionalProperties": false, - "properties": { - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "product_uid": { - "title": "Product Identifier", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "traits": { - "items": { - "$ref": "#/$defs/trait" - }, - "title": "Traits", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Related Event/Finding", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "score": { - "title": "Reputation Score", - "type": "string" - }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", - "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "resource_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "criticality": { - "title": "Criticality", - "type": "string" - }, - "data": { - "title": "Data" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Resource Relationship" - }, - "role": { - "title": "Role", - "type": "string" - }, - "role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Role ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Resource Details", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", - "type": "string" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "span": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "ticket": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Ticket Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Ticket Status ID", - "type": "integer" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Ticket Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Ticket Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Ticket", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Time Span Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "tls": { - "additionalProperties": false, - "properties": { - "alert": { - "title": "Client TLS Alert", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "certificate_chain": { - "items": { - "type": "string" - }, - "title": "Certificate Chain", - "type": "array" - }, - "cipher": { - "title": "Cipher Suite", - "type": "string" - }, - "client_ciphers": { - "items": { - "type": "string" - }, - "title": "Client Cipher Suites", - "type": "array" - }, - "extension_list": { - "items": { - "$ref": "#/$defs/tls_extension" - }, - "title": "Extension List", - "type": "array" - }, - "handshake_dur": { - "title": "Handshake Duration", - "type": "integer" - }, - "ja3_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3 Hash" - }, - "ja3s_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3S Hash" - }, - "key_length": { - "title": "Key Length", - "type": "integer" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "server_ciphers": { - "items": { - "type": "string" - }, - "title": "Server Cipher Suites", - "type": "array" - }, - "sni": { - "title": "Server Name Indication", - "type": "string" - }, - "tls_extension_list": { - "items": { - "$ref": "#/$defs/tls_extension" - }, - "title": "TLS Extension List", - "type": "array" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Transport Layer Security (TLS)", - "type": "object" - }, - "tls_extension": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 5, - 10, - 13, - 14, - 15, - 16, - 18, - 19, - 20, - 21, - 41, - 42, - 43, - 44, - 45, - 47, - 48, - 49, - 50, - 51, - 99 - ], - "title": "Type ID", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "TLS Extension", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "trait": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "title": "Trait", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "account" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "forward_addr": { - "title": "Forwarding Address", - "type": "string" - }, - "full_name": { - "title": "Full Name", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vendor_attributes": { - "additionalProperties": false, - "properties": { - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - } - }, - "title": "Vendor Attributes", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] - }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" - }, - "exploit_type": { - "title": "Exploit Type", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Vulnerability Details", - "type": "object" - }, - "whois": { - "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" - } - }, - "title": "WHOIS", - "type": "object" - }, - "win_reg_key": { - "additionalProperties": false, - "properties": { - "is_system": { - "title": "System", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - } - }, - "required": [ - "path" - ], - "title": "Registry Key", - "type": "object" - }, - "win_reg_value": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" - }, - "is_default": { - "title": "Default Value", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "reg_binary_data": { - "title": "Registry Binary Data", - "type": "string" - }, - "reg_integer_data": { - "title": "Registry Integer Data", - "type": "integer" - }, - "reg_string_data": { - "title": "Registry String Data", - "type": "string" - }, - "reg_string_list_data": { - "items": { - "type": "string" - }, - "title": "Registry String List Data", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Type ID", - "type": "integer" - } - }, - "required": [ - "name", - "path" - ], - "title": "Registry Value", - "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" - ] - }, - { - "required": [ - "service_start_type_id" - ] - }, - { - "required": [ - "service_type_id" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "service_category": { - "title": "Service Category", - "type": "string" - }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", - "type": "string" - }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", - "type": "integer" - }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" - }, - "service_start_name": { - "title": "Service Start Name", - "type": "string" - }, - "service_start_type": { - "title": "Service Start Type", - "type": "string" - }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", - "type": "string" - }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Windows Service", - "type": "object" - } - }, - "$id": "https://schema.ocsf.io/schema/classes/detection_finding", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "properties": { - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" - }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Activity ID", - "type": "integer" - }, - "activity_name": { - "title": "Activity", - "type": "string" - }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "anomaly_analyses": { - "items": { - "$ref": "#/$defs/anomaly_analysis" - }, - "title": "Anomaly Analyses", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "category_name": { - "title": "Category", - "type": "string" - }, - "category_uid": { - "const": 2, - "title": "Category ID", - "type": "integer" - }, - "class_name": { - "title": "Class", - "type": "string" - }, - "class_uid": { - "const": 2004, - "title": "Class ID", - "type": "integer" - }, - "comment": { - "title": "Comment", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "confidence_score": { - "title": "Confidence Score", - "type": "integer" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "disposition": { - "title": "Disposition", - "type": "string" - }, - "disposition_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 99 - ], - "title": "Disposition ID", - "type": "integer" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "enrichments": { - "items": { - "$ref": "#/$defs/enrichment" - }, - "title": "Enrichments", - "type": "array" - }, - "evidences": { - "items": { - "$ref": "#/$defs/evidences" - }, - "title": "Evidence Artifacts", - "type": "array" - }, - "finding_info": { - "$ref": "#/$defs/finding_info", - "title": "Finding Information" - }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "impact": { - "title": "Impact", - "type": "string" - }, - "impact_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Impact ID", - "type": "integer" - }, - "impact_score": { - "title": "Impact Score", - "type": "integer" - }, - "is_alert": { - "title": "Alert", - "type": "boolean" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" - }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "resources": { - "items": { - "$ref": "#/$defs/resource_details" - }, - "title": "Affected Resources", - "type": "array" - }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "timezone_offset": { - "title": "Timezone Offset", - "type": "integer" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" - }, - "vendor_attributes": { - "$ref": "#/$defs/vendor_attributes", - "title": "Vendor Attributes" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Vulnerabilities", - "type": "array" - } - }, - "required": [ - "activity_id", - "category_uid", - "class_uid", - "finding_info", - "metadata", - "severity_id", - "time", - "type_uid" - ], - "title": "Detection Finding", - "type": "object" -} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/device_config_state_change@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/device_config_state_change@container+host+security_control+trace.json deleted file mode 100644 index bb06a92d32..0000000000 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/device_config_state_change@container+host+security_control+trace.json +++ /dev/null @@ -1,7170 +0,0 @@ -{ - "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for device_config_state_change. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", - "$defs": { - "account": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Advisory ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Advisory", - "type": "object" - }, - "affected_code": { - "additionalProperties": false, - "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" - }, - "start_column": { - "title": "Start Column", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "required": [ - "file" - ], - "title": "Affected Code", - "type": "object" - }, - "affected_package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "fixed_in_version": { - "title": "Fixed In Version", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", - "type": "object" - }, - "agent": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Agent Name", - "type": "string" - }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Agent ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate Agent ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Agent Version", - "type": "string" - } - }, - "title": "Agent", - "type": "object" - }, - "analytic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" - }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "operation" - ], - "title": "API", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" - }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "factor_type": { - "title": "Factor Type", - "type": "string" - }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" - }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" - }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - }, - "zone": { - "title": "Cloud Availability Zone", - "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Container", - "type": "object" - }, - "cve": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Vulnerability Type", - "type": "string" - }, - "uid": { - "title": "CVE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "vector_string": { - "title": "Vector String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "CWE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CWE", - "type": "object" - }, - "d3f_tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Technique", - "type": "object" - }, - "d3fend": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], - "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "category_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Category ID", - "type": "integer" - }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Data Classification", - "type": "object" - }, - "device": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "eid": { - "title": "EID", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", - "type": "string" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", - "type": "string" - }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "meid": { - "title": "MEID", - "type": "string" - }, - "model": { - "title": "Model", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "region": { - "title": "Region", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "subnet": { - "title": "Subnet", - "type": "string" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Device", - "type": "object" - }, - "device_hw_info": { - "additionalProperties": false, - "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" - }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", - "type": "string" - }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" - }, - "chassis": { - "title": "Chassis", - "type": "string" - }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" - }, - "cpu_architecture_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" - }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" - }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" - }, - "cpu_type": { - "title": "Processor Type", - "type": "string" - }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", - "type": "integer" - }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" - }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" - }, - "ram_size": { - "title": "RAM Size", - "type": "integer" - }, - "serial_number": { - "title": "Serial Number", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "developer_uid": { - "title": "Developer UID", - "type": "string" - }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" - }, - "type": { - "title": "Encryption Type", - "type": "string" - } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "score" - ], - "title": "EPSS", - "type": "object" - }, - "extension": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "drive_type": { - "title": "Drive Type", - "type": "string" - }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, - "name": { - "title": "Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "File", - "type": "object" - }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "condition": { - "title": "Condition", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "match_details": { - "items": { - "type": "string" - }, - "title": "Match Details", - "type": "array" - }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", - "type": "integer" - }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", - "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" - } - }, - "title": "GPU Information", - "type": "object" - }, - "group": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" - }, - "type": { - "title": "Group Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "KB Article", - "type": "object" - }, - "key_value_object": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "required": [ - "name" - ], - "title": "Key:Value object", - "type": "object" - }, - "keyboard_info": { - "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "office_location": { - "title": "Office Location", - "type": "string" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "surname": { - "title": "Surname", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" - }, - "city": { - "title": "City", - "type": "string" - }, - "continent": { - "title": "Continent", - "type": "string" - }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" - }, - "geohash": { - "title": "Geohash", - "type": "string" - }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" - }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" - }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", - "type": "object" - }, - "metadata": { - "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_source": { - "title": "Log Source", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", - "type": "string" - }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" - }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", - "type": "object" - }, - "observable": { - "additionalProperties": false, - "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", - "type": "string" - }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "title": "Occurrence Details", - "type": "object" - }, - "organization": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Package", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "title": "Process", - "type": "object" - }, - "process_entity": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "score": { - "title": "Reputation Score", - "type": "string" - }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", - "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", - "type": "string" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "security_state": { - "additionalProperties": false, - "properties": { - "state": { - "title": "Security State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 99 - ], - "title": "Security State ID", - "type": "integer" - } - }, - "title": "Security State", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "span": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Time Span Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "account" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "forward_addr": { - "title": "Forwarding Address", - "type": "string" - }, - "full_name": { - "title": "Full Name", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] - }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" - }, - "exploit_type": { - "title": "Exploit Type", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Vulnerability Details", - "type": "object" - }, - "whois": { - "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" - } - }, - "title": "WHOIS", - "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" - ] - }, - { - "required": [ - "service_start_type_id" - ] - }, - { - "required": [ - "service_type_id" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "service_category": { - "title": "Service Category", - "type": "string" - }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", - "type": "string" - }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", - "type": "integer" - }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" - }, - "service_start_name": { - "title": "Service Start Name", - "type": "string" - }, - "service_start_type": { - "title": "Service Start Type", - "type": "string" - }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", - "type": "string" - }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Windows Service", - "type": "object" - } - }, - "$id": "https://schema.ocsf.io/schema/classes/device_config_state_change", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "properties": { - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" - }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Activity ID", - "type": "integer" - }, - "activity_name": { - "title": "Activity", - "type": "string" - }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "category_name": { - "title": "Category", - "type": "string" - }, - "category_uid": { - "const": 5, - "title": "Category ID", - "type": "integer" - }, - "class_name": { - "title": "Class", - "type": "string" - }, - "class_uid": { - "const": 5019, - "title": "Class ID", - "type": "integer" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "confidence_score": { - "title": "Confidence Score", - "type": "integer" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "disposition": { - "title": "Disposition", - "type": "string" - }, - "disposition_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 99 - ], - "title": "Disposition ID", - "type": "integer" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "enrichments": { - "items": { - "$ref": "#/$defs/enrichment" - }, - "title": "Enrichments", - "type": "array" - }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "is_alert": { - "title": "Alert", - "type": "boolean" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "prev_security_level": { - "title": "Previous Security Level", - "type": "string" - }, - "prev_security_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Previous Security Level ID", - "type": "integer" - }, - "prev_security_states": { - "items": { - "$ref": "#/$defs/security_state" - }, - "title": "Previous Security States", - "type": "array" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" - }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" - }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "security_level": { - "title": "Security Level", - "type": "string" - }, - "security_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Security Level ID", - "type": "integer" - }, - "security_states": { - "items": { - "$ref": "#/$defs/security_state" - }, - "title": "Security States", - "type": "array" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "state": { - "title": "Config Change State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Config Change State ID", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "timezone_offset": { - "title": "Timezone Offset", - "type": "integer" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" - } - }, - "required": [ - "activity_id", - "category_uid", - "class_uid", - "device", - "metadata", - "severity_id", - "time", - "type_uid" - ], - "title": "Device Config State Change", - "type": "object" -} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json index e038fa211d..654712b727 100644 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json +++ b/crates/openshell-ocsf-validate/schemas/v1.8.0/http_activity@container+host+network_proxy+security_control+trace.json @@ -1,11 +1,11 @@ { "$defs": { - "account": { + "kb_article": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "src_url" ] }, { @@ -14,152 +14,6 @@ ] } ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, "properties": { "avg_timespan": { "$ref": "#/$defs/timespan", @@ -177,10 +31,6 @@ "title": "Created Time", "type": "integer" }, - "desc": { - "title": "Description", - "type": "string" - }, "install_state": { "title": "Install State", "type": "string" @@ -200,10 +50,6 @@ "title": "The patch is superseded.", "type": "boolean" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, "os": { "$ref": "#/$defs/os", "title": "OS" @@ -212,26 +58,9 @@ "$ref": "#/$defs/product", "title": "Product" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "severity": { + "title": "Severity", + "type": "string" }, "size": { "title": "Size", @@ -246,533 +75,549 @@ "type": "string" }, "uid": { - "title": "Advisory ID", + "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Advisory", + "title": "KB Article", "type": "object" }, - "affected_code": { + "long_string": { "additionalProperties": false, "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" }, - "start_column": { - "title": "Start Column", + "untruncated_size": { + "title": "Untruncated Size", "type": "integer" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "file" + "value" ], - "title": "Affected Code", + "title": "Long String", "type": "object" }, - "affected_package": { + "enrichment": { "additionalProperties": false, "properties": { - "architecture": { - "title": "Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpe_name": { - "title": "The product CPE identifier", + "data": { + "title": "Data" + }, + "desc": { + "title": "Description", "type": "string" }, - "epoch": { - "title": "Epoch", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "fixed_in_version": { - "title": "Fixed In Version", + "provider": { + "title": "Provider", "type": "string" }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "license": { - "title": "Software License", + "short_desc": { + "title": "Short Description", "type": "string" }, - "license_url": { - "title": "Software License URL", + "src_url": { + "title": "Source URL", "type": "string" }, - "name": { - "title": "Name", + "type": { + "title": "Type", "type": "string" }, - "package_manager": { - "title": "Package Manager", + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "data", + "name", + "value" + ], + "title": "Enrichment", + "type": "object" + }, + "ldap_person": { + "additionalProperties": false, + "properties": { + "cost_center": { + "title": "Cost Center", "type": "string" }, - "package_manager_url": { - "title": "Package Manager URL", + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "deleted_time": { + "title": "Deleted Time", + "type": "integer" + }, + "department": { + "title": "Department", "type": "string" }, - "path": { - "title": "Path", + "display_name": { + "title": "Display Name", "type": "string" }, - "purl": { - "title": "Package URL", + "email_addrs": { + "items": { + "type": "string" + }, + "title": "Email Addresses", + "type": "array" + }, + "employee_uid": { + "title": "Employee ID", "type": "string" }, - "release": { - "title": "Software Release Details", + "given_name": { + "title": "Given Name", "type": "string" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "hire_time": { + "title": "Hire Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "job_title": { + "title": "Job Title", "type": "string" }, - "type": { - "title": "Type", + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "last_login_time": { + "title": "Last Login", + "type": "integer" + }, + "ldap_cn": { + "title": "LDAP Common Name", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", + "ldap_dn": { + "title": "LDAP Distinguished Name", + "type": "string" + }, + "leave_time": { + "title": "Leave Time", "type": "integer" }, - "uid": { - "title": "Package UID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "manager": { + "$ref": "#/$defs/user", + "title": "Manager" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "office_location": { + "title": "Office Location", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "phone_number": { + "title": "Telephone Number", "type": "string" }, - "version": { - "title": "Version", + "surname": { + "title": "Surname", "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" } }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", + "title": "LDAP Person", "type": "object" }, - "agent": { + "email_auth": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "name": { - "title": "Agent Name", + "dkim": { + "title": "DKIM Status", "type": "string" }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" + "dkim_domain": { + "title": "DKIM Domain", + "type": "string" }, - "type": { - "title": "Agent Type", + "dkim_signature": { + "title": "DKIM Signature", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "dmarc": { + "title": "DMARC Status", + "type": "string" }, - "uid": { - "title": "Agent ID", + "dmarc_override": { + "title": "DMARC Override", "type": "string" }, - "uid_alt": { - "title": "Alternate Agent ID", + "dmarc_policy": { + "title": "DMARC Policy", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "spf": { + "title": "SPF Status", + "type": "string" + } + }, + "title": "Email Authentication", + "type": "object" + }, + "epss": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "percentile": { + "title": "EPSS Percentile", + "type": "number" + }, + "score": { + "title": "EPPS Score", "type": "string" }, "version": { - "title": "Agent Version", + "title": "Version", "type": "string" } }, - "title": "Agent", + "required": [ + "score" + ], + "title": "EPSS", "type": "object" }, - "analytic": { + "endpoint_connection": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "code" ] }, { "required": [ - "uid" + "network_endpoint" ] } ], "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" + "code": { + "title": "Response Code", + "type": "integer" }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" + "network_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Network Endpoint" + } + }, + "title": "Endpoint Connection", + "type": "object" + }, + "device_hw_info": { + "additionalProperties": false, + "properties": { + "bios_date": { + "title": "BIOS Date", + "type": "string" }, - "state": { - "title": "State", + "bios_manufacturer": { + "title": "BIOS Manufacturer", "type": "string" }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" + "bios_ver": { + "title": "BIOS Version", + "type": "string" }, - "type": { - "title": "Type", + "chassis": { + "title": "Chassis", "type": "string" }, - "type_id": { + "cpu_architecture": { + "title": "CPU Architecture", + "type": "string" + }, + "cpu_architecture_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, 99 ], - "title": "Type ID", + "title": "CPU Architecture ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" + "cpu_cores": { + "title": "CPU Cores", + "type": "integer" }, - "operation": { - "title": "Operation", + "cpu_count": { + "title": "CPU Count", + "type": "integer" + }, + "cpu_speed": { + "title": "Processor Speed", + "type": "integer" + }, + "cpu_type": { + "title": "Processor Type", "type": "string" }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" + "desktop_display": { + "$ref": "#/$defs/display", + "title": "Desktop Display" }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" + "gpu_count": { + "title": "GPU Count", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "gpu_info_list": { + "items": { + "$ref": "#/$defs/gpu_info" + }, + "title": "GPU information", + "type": "array" }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" + "keyboard_info": { + "$ref": "#/$defs/keyboard_info", + "title": "Keyboard Information" }, - "version": { - "title": "Version", + "ram_size": { + "title": "RAM Size", + "type": "integer" + }, + "serial_number": { + "title": "Serial Number", + "type": "string" + }, + "uuid": { + "title": "UUID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "required": [ - "operation" - ], - "title": "API", + "title": "Device Hardware Info", "type": "object" }, - "attack": { + "network_proxy": { "additionalProperties": false, "anyOf": [ { "required": [ - "sub_technique" + "domain" ] }, { "required": [ - "tactic" + "hostname" ] }, { "required": [ - "technique" + "instance_uid" ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" + { + "required": [ + "interface_name" + ] }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" + { + "required": [ + "interface_uid" + ] }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" + { + "required": [ + "ip" + ] }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" + { + "required": [ + "name" + ] }, - "version": { - "title": "Version", - "type": "string" + { + "required": [ + "svc_name" + ] + }, + { + "required": [ + "uid" + ] } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, + ], "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "factor_type": { - "title": "Factor Type", + "uid": { + "title": "Unique ID", "type": "string" }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" + "interface_uid": { + "title": "Network Interface ID", + "type": "string" }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" + "port": { + "title": "Port", + "type": "integer" }, - "phone_number": { - "title": "Phone Number", + "type": { + "title": "Type", "type": "string" }, - "provider": { - "title": "Provider", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", + "mac": { + "title": "MAC Address", "type": "string" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", "type": "string" }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { "name": { "title": "Name", "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", + }, + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "expiration_time": { - "title": "Expiration Time", + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" + }, + "svc_name": { + "title": "Service Name", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 99 + ], + "title": "Type ID", "type": "integer" }, + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, "fingerprints": { "items": { "$ref": "#/$defs/fingerprint" @@ -780,384 +625,434 @@ "title": "Fingerprints", "type": "array" }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" + "vpc_uid": { + "title": "VPC UID", + "type": "string" }, - "issuer": { - "title": "Issuer Distinguished Name", + "domain": { + "title": "Domain", "type": "string" }, - "sans": { + "agent_list": { "items": { - "$ref": "#/$defs/san" + "$ref": "#/$defs/agent" }, - "title": "Subject Alternative Names", + "title": "Agent List", "type": "array" }, - "serial_number": { - "title": "Certificate Serial Number", + "ip": { + "title": "IP Address", "type": "string" }, - "subject": { - "title": "Subject Distinguished Name", + "hostname": { + "title": "Hostname", "type": "string" }, - "uid": { - "title": "Unique ID", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "version": { - "title": "Version", + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", + "title": "Network Proxy Endpoint", "type": "object" }, - "cis_control": { + "data_classification": { "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" + "anyOf": [ + { + "required": [ + "category_id" + ] }, - "version": { - "title": "Version", - "type": "string" + { + "required": [ + "confidentiality_id" + ] } - }, - "required": [ - "name" ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, "properties": { - "name": { - "title": "Name", + "category": { + "title": "Category", "type": "string" }, - "type": { - "title": "Type", - "type": "string" + "category_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Category ID", + "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" + "classifier_details": { + "$ref": "#/$defs/classifier_details", + "title": "Classifier Details" }, - "zone": { - "title": "Cloud Availability Zone", + "confidentiality": { + "title": "Confidentiality", "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "confidentiality_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Confidentiality ID", + "type": "integer" }, - "labels": { + "discovery_details": { "items": { - "type": "string" + "$ref": "#/$defs/discovery_details" }, - "title": "Labels", + "title": "Discovery Details", "type": "array" }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" }, "size": { "title": "Size", "type": "integer" }, - "tag": { - "title": "Image Tag", + "src_url": { + "title": "Source URL", "type": "string" }, - "tags": { + "status": { + "title": "Status", + "type": "string" + }, + "status_details": { "items": { - "$ref": "#/$defs/key_value_object" + "type": "string" }, - "title": "Tags", + "title": "Status Details", "type": "array" }, + "status_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Status ID", + "type": "integer" + }, + "total": { + "title": "Total", + "type": "integer" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "Container", + "title": "Data Classification", "type": "object" }, - "cve": { + "http_response": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", + "body_length": { + "title": "Response Body Length", "type": "integer" }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", + "code": { + "title": "Response Code", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "content_type": { + "title": "HTTP Content Type", + "type": "string" }, - "references": { + "http_headers": { "items": { - "type": "string" + "$ref": "#/$defs/http_header" }, - "title": "References", + "title": "HTTP Headers", "type": "array" }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" + "latency": { + "title": "Latency", + "type": "integer" }, - "title": { - "title": "Title", - "type": "string" + "length": { + "title": "Response Length", + "type": "integer" }, - "type": { - "title": "Vulnerability Type", + "message": { + "title": "Message", "type": "string" }, - "uid": { - "title": "CVE ID", + "status": { + "title": "Status", "type": "string" } }, "required": [ - "uid" + "code" ], - "title": "CVE", + "title": "HTTP Response", "type": "object" }, - "cvss": { + "display": { "additionalProperties": false, "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" + "color_depth": { + "title": "Color Depth", + "type": "integer" }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" + "physical_height": { + "title": "Physical Height", + "type": "integer" }, - "overall_score": { - "title": "Overall Score", - "type": "number" + "physical_orientation": { + "title": "Physical Orientation", + "type": "integer" }, - "severity": { - "title": "Severity", - "type": "string" + "physical_width": { + "title": "Physical Width", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "scale_factor": { + "title": "Scale Factor", + "type": "integer" + } + }, + "title": "Display", + "type": "object" + }, + "scim": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", "type": "string" }, - "vector_string": { - "title": "Vector String", + "auth_protocol_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 99 + ], + "title": "Auth Protocol ID", + "type": "integer" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "error_message": { + "title": "Last Error Message", + "type": "string" + }, + "is_group_provisioning_enabled": { + "title": "SCIM Group Provisioning Enabled", + "type": "boolean" + }, + "is_user_provisioning_enabled": { + "title": "SCIM User Provisioning Enabled", + "type": "boolean" + }, + "last_run_time": { + "title": "Last Sync Time", + "type": "integer" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "protocol_name": { + "title": "Supported Protocol", + "type": "string" + }, + "rate_limit": { + "title": "Rate Limit", + "type": "integer" + }, + "scim_group_schema": { + "title": "SCIM Group Schema" + }, + "scim_user_schema": { + "title": "SCIM User Schema" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "State ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "External ID", + "type": "string" + }, + "url_string": { + "title": "SCIM Endpoint URL", "type": "string" }, "vendor_name": { - "title": "Vendor Name", + "title": "Service Provider", "type": "string" }, "version": { - "title": "Version", + "title": "SCIM Version", "type": "string" } }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", + "title": "SCIM", "type": "object" }, - "cwe": { + "programmatic_credential": { "additionalProperties": false, "properties": { - "caption": { - "title": "Caption", - "type": "string" + "last_used_time": { + "title": "Last Used Time", + "type": "integer" }, - "src_url": { - "title": "Source URL", + "type": { + "title": "Type", "type": "string" }, "uid": { - "title": "CWE ID", + "title": "Unique ID", "type": "string" } }, "required": [ "uid" ], - "title": "CWE", + "title": "Programmatic Credential", "type": "object" }, - "d3f_tactic": { + "os": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { + "build": { + "title": "OS Build", + "type": "string" + }, + "country": { + "title": "Country", + "type": "string" + }, + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "cpu_bits": { + "title": "CPU Bits", + "type": "integer" + }, + "edition": { + "title": "OS Edition", + "type": "string" + }, + "kernel_release": { + "title": "Kernel Release", + "type": "string" + }, + "lang": { + "title": "Language", + "type": "string" + }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "sp_name": { + "title": "OS Service Pack", "type": "string" }, - "uid": { - "title": "Unique ID", + "sp_ver": { + "title": "OS Service Pack Version", + "type": "integer" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 99, + 100, + 101, + 200, + 201, + 300, + 301, + 302, + 400, + 401, + 402 + ], + "title": "Type ID", + "type": "integer" + }, + "version": { + "title": "Version", "type": "string" } }, - "title": "MITRE D3FEND\u2122 Tactic", + "required": [ + "name", + "type_id" + ], + "title": "Operating System (OS)", "type": "object" }, - "d3f_technique": { + "tactic": { "additionalProperties": false, "anyOf": [ { @@ -1185,60 +1080,101 @@ "type": "string" } }, - "title": "MITRE D3FEND\u2122 Technique", + "title": "MITRE Tactic", "type": "object" }, - "d3fend": { + "dns_answer": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", + "class": { + "title": "Resource Record Class", "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] }, - { - "required": [ - "confidentiality_id" - ] + "flag_ids": { + "items": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "type": "integer" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "DNS Header Flags", + "type": "array" + }, + "packet_uid": { + "title": "Packet UID", + "type": "integer" + }, + "rdata": { + "title": "DNS RData", + "type": "string" + }, + "ttl": { + "title": "TTL", + "type": "integer" + }, + "type": { + "title": "Resource Record Type", + "type": "string" } + }, + "required": [ + "rdata" ], + "title": "DNS Answer", + "type": "object" + }, + "discovery_details": { + "additionalProperties": false, "properties": { - "category": { - "title": "Category", + "count": { + "title": "Count", + "type": "integer" + }, + "occurrence_details": { + "$ref": "#/$defs/occurrence_details", + "title": "Occurrence Details" + }, + "occurrences": { + "items": { + "$ref": "#/$defs/occurrence_details" + }, + "title": "Occurrences", + "type": "array" + }, + "type": { + "title": "Type", "type": "string" }, - "category_id": { + "value": { + "title": "Value", + "type": "string" + } + }, + "title": "Discovery Details", + "type": "object" + }, + "sso": { + "additionalProperties": false, + "properties": { + "auth_protocol": { + "title": "Auth Protocol", + "type": "string" + }, + "auth_protocol_id": { "enum": [ 0, 1, @@ -1247,943 +1183,1042 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, 99 ], - "title": "Category ID", + "title": "Auth Protocol ID", "type": "integer" }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "SAML Certificate" }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", + "duration_mins": { + "title": "SSO Session Duration", "type": "integer" }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" + "idle_timeout": { + "title": "SSO Idle Timeout", + "type": "integer" }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "login_endpoint": { + "title": "SSO Login Endpoint", + "type": "string" }, - "size": { - "title": "Size", + "logout_endpoint": { + "title": "SSO Logout Endpoint", + "type": "string" + }, + "metadata_endpoint": { + "title": "SSO Metadata Endpoint", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "src_url": { - "title": "Source URL", + "name": { + "title": "Name", "type": "string" }, - "status": { - "title": "Status", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "status_details": { + "scopes": { "items": { "type": "string" }, - "title": "Status Details", + "title": "Scopes", "type": "array" }, - "status_id": { + "uid": { + "title": "Unique ID", + "type": "string" + }, + "vendor_name": { + "title": "Service Provider", + "type": "string" + } + }, + "title": "SSO", + "type": "object" + }, + "token": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_renewable": { + "title": "Renewable", + "type": "boolean" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "name": { + "title": "Name", + "type": "string" + }, + "tenant_uid": { + "title": "Tenant UID", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, + 7, 99 ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" } }, - "title": "Data Classification", + "title": "Token", "type": "object" }, - "device": { + "api": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] + "properties": { + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - { - "required": [ - "instance_uid" - ] + "operation": { + "title": "Operation", + "type": "string" }, - { - "required": [ - "interface_name" - ] + "request": { + "$ref": "#/$defs/request", + "title": "API Request Details" }, - { - "required": [ - "interface_uid" - ] + "response": { + "$ref": "#/$defs/response", + "title": "API Response Details" }, - { - "required": [ - "ip" - ] + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "token": { + "$ref": "#/$defs/token", + "title": "Token" }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "operation" + ], + "title": "API", + "type": "object" + }, + "d3fend": { + "additionalProperties": false, + "anyOf": [ { "required": [ - "name" + "d3f_tactic" ] }, { "required": [ - "uid" + "d3f_technique" ] } ], "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + "d3f_tactic": { + "$ref": "#/$defs/d3f_tactic", + "title": "MITRE D3FEND\u2122 Tactic" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "d3f_technique": { + "$ref": "#/$defs/d3f_technique", + "title": "MITRE D3FEND\u2122 Technique" }, - "desc": { - "title": "Description", + "version": { + "title": "Version", "type": "string" + } + }, + "title": "MITRE D3FEND\u2122", + "type": "object" + }, + "reputation": { + "additionalProperties": false, + "properties": { + "base_score": { + "title": "Reputation Score", + "type": "number" }, - "domain": { - "title": "Domain", + "provider": { + "title": "Provider", "type": "string" }, - "eid": { - "title": "EID", + "score": { + "title": "Reputation Score", "type": "string" }, - "first_seen_time": { - "title": "First Seen", + "score_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "Reputation Score ID", "type": "integer" + } + }, + "required": [ + "base_score", + "score_id" + ], + "title": "Reputation", + "type": "object" + }, + "mitigation": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "groups": { + { + "required": [ + "uid" + ] + } + ], + "properties": { + "countermeasures": { "items": { - "$ref": "#/$defs/group" + "$ref": "#/$defs/d3fend" }, - "title": "Groups", + "title": "Countermeasures", "type": "array" }, - "hostname": { - "title": "Hostname", + "name": { + "title": "Name", "type": "string" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "src_url": { + "title": "Source URL", + "type": "string" }, - "hypervisor": { - "title": "Hypervisor", + "uid": { + "title": "Unique ID", "type": "string" + } + }, + "title": "MITRE Mitigation", + "type": "object" + }, + "location": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "city" + ] }, - "iccid": { - "title": "ICCID", + { + "required": [ + "country" + ] + }, + { + "required": [ + "postal_code" + ] + }, + { + "required": [ + "region" + ] + } + ], + "properties": { + "aerial_height": { + "title": "Aerial Height", "type": "string" }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" + "city": { + "title": "City", + "type": "string" }, - "imei": { - "title": "IMEI", + "continent": { + "title": "Continent", "type": "string" }, - "imei_list": { + "coordinates": { "items": { - "type": "string" + "type": "number" }, - "title": "IMEI List", + "title": "Coordinates", "type": "array" }, - "instance_uid": { - "title": "Instance ID", + "country": { + "title": "Country", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "desc": { + "title": "Description", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "geodetic_altitude": { + "title": "Geodetic Altitude", "type": "string" }, - "ip": { - "title": "IP Address", + "geodetic_vertical_accuracy": { + "title": "Geodetic Vertical Accuracy", "type": "string" }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" + "geohash": { + "title": "Geohash", + "type": "string" }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" + "horizontal_accuracy": { + "title": "Horizontal Accuracy", + "type": "string" }, - "is_mobile_account_active": { - "title": "Mobile Account Active", + "is_on_premises": { + "title": "On-Premises", "type": "boolean" }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" + "isp": { + "title": "ISP Name", + "type": "string" }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" + "lat": { + "title": "Latitude", + "type": "number" }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" + "long": { + "title": "Longitude", + "type": "number" }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" + "postal_code": { + "title": "Postal Code", + "type": "string" }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "pressure_altitude": { + "title": "Pressure Altitude", + "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", + "provider": { + "title": "Provider", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", + "region": { + "title": "Region", "type": "string" + } + }, + "title": "Geo Location", + "type": "object" + }, + "network_traffic": { + "additionalProperties": false, + "properties": { + "bytes": { + "title": "Total Bytes", + "type": "integer" }, - "meid": { - "title": "MEID", - "type": "string" + "bytes_in": { + "title": "Bytes In", + "type": "integer" }, - "model": { - "title": "Model", - "type": "string" + "bytes_missed": { + "title": "Bytes Missed", + "type": "integer" }, - "modified_time": { - "title": "Modified Time", + "bytes_out": { + "title": "Bytes Out", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "chunks": { + "title": "Chunks", + "type": "integer" }, - "namespace_pid": { - "title": "Namespace PID", + "chunks_in": { + "title": "Chunks In", "type": "integer" }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" + "chunks_out": { + "title": "Chunks Out", + "type": "integer" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "end_time": { + "title": "End Time", + "type": "integer" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "packets": { + "title": "Total Packets", + "type": "integer" }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" + "packets_in": { + "title": "Packets In", + "type": "integer" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "packets_out": { + "title": "Packets Out", + "type": "integer" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "start_time": { + "title": "Start Time", + "type": "integer" }, - "region": { - "title": "Region", - "type": "string" + "timespan": { + "$ref": "#/$defs/timespan", + "title": "Time Span" + } + }, + "title": "Network Traffic", + "type": "object" + }, + "idp": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] }, - "risk_level": { - "title": "Risk Level", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "auth_factors": { + "items": { + "$ref": "#/$defs/auth_factor" + }, + "title": "Authentication Factors", + "type": "array" + }, + "domain": { + "title": "Domain", "type": "string" }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" + "fingerprint": { + "$ref": "#/$defs/fingerprint", + "title": "Certificate Fingerprint" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "has_mfa": { + "title": "MFA Enforced", + "type": "boolean" }, - "subnet": { - "title": "Subnet", + "issuer": { + "title": "Issuer Details", "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "name": { + "title": "Name", "type": "string" }, - "type": { - "title": "Type", + "protocol_name": { + "title": "Supported Protocol", "type": "string" }, - "type_id": { + "scim": { + "$ref": "#/$defs/scim", + "title": "SCIM" + }, + "sso": { + "$ref": "#/$defs/sso", + "title": "SSO" + }, + "state": { + "title": "State", + "type": "string" + }, + "state_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "State ID", "type": "integer" }, - "udid": { - "title": "Unique Device Identifier", + "tenant_uid": { + "title": "Tenant UID", "type": "string" }, "uid": { "title": "Unique ID", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", + "url_string": { + "title": "Configuration URL", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Device", + "title": "Identity Provider", "type": "object" }, - "device_hw_info": { + "process": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" + "ancestry": { + "items": { + "$ref": "#/$defs/process_entity" + }, + "title": "Ancestry", + "type": "array" }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "chassis": { - "title": "Chassis", + "cpid": { + "title": "Common Process Identifier", "type": "string" }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "cpu_architecture_id": { + "environment_variables": { + "items": { + "$ref": "#/$defs/environment_variable" + }, + "title": "Environment Variables", + "type": "array" + }, + "file": { + "$ref": "#/$defs/file", + "title": "File" + }, + "hosted_services": { + "items": { + "$ref": "#/$defs/win_win_service" + }, + "title": "Hosted Services", + "type": "array" + }, + "integrity": { + "title": "Integrity", + "type": "string" + }, + "integrity_id": { "enum": [ 0, 1, 2, 3, + 4, + 5, + 6, 99 ], - "title": "CPU Architecture ID", + "title": "Integrity Level", "type": "integer" }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" + "lineage": { + "items": { + "type": "string" + }, + "title": "Lineage", + "type": "array" }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" + "loaded_modules": { + "items": { + "type": "string" + }, + "title": "Loaded Modules", + "type": "array" }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "cpu_speed": { - "title": "Processor Speed", + "namespace_pid": { + "title": "Namespace PID", "type": "integer" }, - "cpu_type": { - "title": "Processor Type", + "parent_process": { + "$ref": "#/$defs/process", + "title": "Parent Process" + }, + "path": { + "title": "Path", "type": "string" }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" + "pid": { + "title": "Process ID", + "type": "integer" }, - "gpu_count": { - "title": "GPU Count", + "ptid": { + "title": "Process Thread ID", "type": "integer" }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" + "sandbox": { + "title": "Sandbox", + "type": "string" }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "ram_size": { - "title": "RAM Size", + "terminated_time": { + "title": "Terminated Time", "type": "integer" }, - "serial_number": { - "title": "Serial Number", - "type": "string" + "tid": { + "title": "Thread ID", + "type": "integer" }, - "uuid": { - "title": "UUID", + "uid": { + "title": "Unique ID", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "user": { + "$ref": "#/$defs/user", + "title": "User" + }, + "working_directory": { + "title": "Working Directory", "type": "string" + }, + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" } }, - "title": "Device Hardware Info", + "title": "Process", "type": "object" }, - "digital_signature": { + "vulnerability": { "additionalProperties": false, + "oneOf": [ + { + "not": { + "required": [ + "cve", + "cwe" + ] + }, + "required": [ + "advisory" + ] + }, + { + "not": { + "required": [ + "advisory", + "cwe" + ] + }, + "required": [ + "cve" + ] + }, + { + "not": { + "required": [ + "advisory", + "cve" + ] + }, + "required": [ + "cwe" + ] + } + ], "properties": { - "algorithm": { - "title": "Algorithm", + "advisory": { + "$ref": "#/$defs/advisory", + "title": "Security Advisory" + }, + "affected_code": { + "items": { + "$ref": "#/$defs/affected_code" + }, + "title": "Affected Code", + "type": "array" + }, + "affected_packages": { + "items": { + "$ref": "#/$defs/affected_package" + }, + "title": "Affected Software Packages", + "type": "array" + }, + "category": { + "title": "Category", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "cve": { + "$ref": "#/$defs/cve", + "title": "CVE" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" + "cwe": { + "$ref": "#/$defs/cwe", + "title": "CWE" }, - "created_time": { - "title": "Created Time", + "dependency_chain": { + "title": "Dependency Chain", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "exploit_last_seen_time": { + "title": "Exploit Last Seen Time", "type": "integer" }, - "developer_uid": { - "title": "Developer UID", + "exploit_ref_url": { + "title": "Exploit URL", "type": "string" }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" + "exploit_requirement": { + "title": "Exploit Requirement", + "type": "string" }, - "state": { - "title": "State", + "exploit_type": { + "title": "Exploit Type", "type": "string" }, - "state_id": { + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "fix_coverage": { + "title": "Fix Coverage", + "type": "string" + }, + "fix_coverage_id": { "enum": [ 0, 1, 2, 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, 99 ], - "title": "State ID", + "title": "Fix Coverage ID", "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", + }, + "is_exploit_available": { + "title": "Exploit Availability", + "type": "boolean" + }, + "is_fix_available": { + "title": "Fix Availability", + "type": "boolean" + }, + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" + }, + "last_seen_time": { + "title": "Last Seen", "type": "integer" }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" + "packages": { + "items": { + "$ref": "#/$defs/package" + }, + "title": "Software Packages", + "type": "array" }, - "occurrences": { + "references": { "items": { - "$ref": "#/$defs/occurrence_details" + "type": "string" }, - "title": "Occurrences", + "title": "References", "type": "array" }, - "type": { - "title": "Type", + "related_vulnerabilities": { + "items": { + "type": "string" + }, + "title": "Related Vulnerability IDs", + "type": "array" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "severity": { + "title": "Severity", "type": "string" }, - "value": { - "title": "Value", + "title": { + "title": "Title", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", "type": "string" } }, - "title": "Discovery Details", + "title": "Vulnerability Details", "type": "object" }, - "display": { + "affected_code": { "additionalProperties": false, "properties": { - "color_depth": { - "title": "Color Depth", + "end_column": { + "title": "End Column", "type": "integer" }, - "physical_height": { - "title": "Physical Height", + "end_line": { + "title": "End Line", "type": "integer" }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "physical_width": { - "title": "Physical Width", + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" + }, + "rule": { + "$ref": "#/$defs/rule", + "title": "Related Rule" + }, + "start_column": { + "title": "Start Column", "type": "integer" }, - "scale_factor": { - "title": "Scale Factor", + "start_line": { + "title": "Start Line", "type": "integer" } }, - "title": "Display", + "required": [ + "file" + ], + "title": "Affected Code", "type": "object" }, - "dns_answer": { + "keyboard_info": { "additionalProperties": false, "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", + "function_keys": { + "title": "Function Keys", "type": "integer" }, - "rdata": { - "title": "DNS RData", + "ime": { + "title": "IME", "type": "string" }, - "ttl": { - "title": "TTL", + "keyboard_layout": { + "title": "Keyboard Layout", + "type": "string" + }, + "keyboard_subtype": { + "title": "Keyboard Subtype", "type": "integer" }, - "type": { - "title": "Resource Record Type", + "keyboard_type": { + "title": "Keyboard Type", "type": "string" } }, - "required": [ - "rdata" - ], - "title": "DNS Answer", + "title": "Keyboard Information", "type": "object" }, - "domain_contact": { + "certificate": { "additionalProperties": false, "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" + "expiration_time": { + "title": "Expiration Time", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" }, - "phone_number": { - "title": "Phone Number", + "is_self_signed": { + "title": "Certificate Self-Signed", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Distinguished Name", "type": "string" }, - "type": { - "title": "Domain Contact Type", + "sans": { + "items": { + "$ref": "#/$defs/san" + }, + "title": "Subject Alternative Names", + "type": "array" + }, + "serial_number": { + "title": "Certificate Serial Number", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" + "subject": { + "title": "Subject Distinguished Name", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "type_id" + "issuer", + "serial_number" ], - "title": "Domain Contact", + "title": "Digital Certificate", "type": "object" }, - "email": { + "account": { "additionalProperties": false, "anyOf": [ { "required": [ - "from" + "name" ] }, { "required": [ - "to" + "uid" ] } ], "properties": { - "cc": { + "is_disabled": { + "title": "Disabled", + "type": "boolean" + }, + "is_locked": { + "title": "Locked", + "type": "boolean" + }, + "is_on_premises_sync_enabled": { + "title": "On-Premises Sync Enabled", + "type": "boolean" + }, + "labels": { "items": { "type": "string" }, - "title": "Cc", + "title": "Labels", "type": "array" }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", + "name": { + "title": "Name", "type": "string" }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { + "tags": { "items": { - "type": "string" + "$ref": "#/$defs/key_value_object" }, - "title": "X-Originating-IP", + "title": "Tags", "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", + "type": { + "title": "Type", "type": "string" }, - "algorithm_id": { + "type_id": { "enum": [ 0, 1, @@ -2192,151 +2227,156 @@ 4, 5, 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, 99 ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", + "title": "Type ID", "type": "integer" }, - "key_uid": { - "title": "Key UID", + "uid": { + "title": "Unique ID", "type": "string" - }, - "type": { - "title": "Encryption Type", + } + }, + "title": "Account", + "type": "object" + }, + "authorization": { + "additionalProperties": false, + "properties": { + "decision": { + "title": "Authorization Decision/Outcome", "type": "string" + }, + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" } }, - "title": "Encryption Details", + "title": "Authorization Result", "type": "object" }, - "endpoint_connection": { + "autonomous_system": { "additionalProperties": false, "anyOf": [ { "required": [ - "code" + "name" ] }, { "required": [ - "network_endpoint" + "number" ] } ], "properties": { - "code": { - "title": "Response Code", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "network_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Network Endpoint" + "number": { + "title": "Number", + "type": "integer" } }, - "title": "Endpoint Connection", + "title": "Autonomous System", "type": "object" }, - "enrichment": { + "classifier_details": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, "name": { "title": "Name", "type": "string" }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, "type": { "title": "Type", "type": "string" }, - "value": { - "title": "Value", + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "data", - "name", - "value" + "type" ], - "title": "Enrichment", + "title": "Classifier Details", "type": "object" }, - "environment_variable": { + "session": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", - "type": "string" + "count": { + "title": "Count", + "type": "integer" }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { "created_time": { "title": "Created Time", "type": "integer" }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" + "credential_uid": { + "title": "User Credential ID", + "type": "string" }, - "score": { - "title": "EPPS Score", + "expiration_reason": { + "title": "Expiration Reason", "type": "string" }, - "version": { - "title": "Version", + "expiration_time": { + "title": "Expiration Time", + "type": "integer" + }, + "is_mfa": { + "title": "Multi Factor Authentication", + "type": "boolean" + }, + "is_remote": { + "title": "Remote", + "type": "boolean" + }, + "is_vpn": { + "title": "VPN Session", + "type": "boolean" + }, + "issuer": { + "title": "Issuer Details", + "type": "string" + }, + "terminal": { + "title": "Terminal", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" + }, + "uuid": { + "title": "UUID", "type": "string" } }, - "required": [ - "score" - ], - "title": "EPSS", + "title": "Session", "type": "object" }, - "extension": { + "d3f_technique": { "additionalProperties": false, "anyOf": [ { @@ -2355,76 +2395,89 @@ "title": "Name", "type": "string" }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "version" - ], - "title": "Schema Extension", + "title": "MITRE D3FEND\u2122 Technique", "type": "object" }, - "feature": { + "image": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, "name": { "title": "Name", "type": "string" }, - "uid": { - "title": "Unique ID", + "path": { + "title": "Path", "type": "string" }, - "version": { - "title": "Version", + "tag": { + "title": "Image Tag", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Feature", + "required": [ + "uid" + ], + "title": "Image", "type": "object" }, - "file": { + "script": { "additionalProperties": false, "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" + "file": { + "$ref": "#/$defs/file", + "title": "File" }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" + "hashes": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Hashes", + "type": "array" }, - "attributes": { - "title": "Attributes", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "company_name": { - "title": "Company Name", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "confidentiality": { - "title": "Confidentiality", + "script_content": { + "$ref": "#/$defs/long_string", + "title": "Script Content" + }, + "type": { + "title": "Type", "type": "string" }, - "confidentiality_id": { + "type_id": { "enum": [ 0, 1, @@ -2433,139 +2486,86 @@ 4, 5, 6, + 7, 99 ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", + "title": "Type ID", "type": "integer" }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "required": [ + "script_content", + "type_id" + ], + "title": "Script", + "type": "object" + }, + "affected_package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", "type": "string" }, - "drive_type": { - "title": "Drive Type", + "cpe_name": { + "title": "The product CPE identifier", "type": "string" }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", + "epoch": { + "title": "Epoch", "type": "integer" }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", + "fixed_in_version": { + "title": "Fixed In Version", "type": "string" }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "internal_name": { - "title": "Internal Name", + "license": { + "title": "Software License", "type": "string" }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", + "license_url": { + "title": "Software License URL", "type": "string" }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, "name": { "title": "Name", "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "package_manager": { + "title": "Package Manager", + "type": "string" }, - "parent_folder": { - "title": "Parent Folder", + "package_manager_url": { + "title": "Package Manager URL", "type": "string" }, "path": { "title": "Path", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", + "purl": { + "title": "Package URL", "type": "string" }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" + "release": { + "title": "Software Release Details", + "type": "string" }, - "size": { - "title": "Size", - "type": "integer" + "remediation": { + "$ref": "#/$defs/remediation", + "title": "Remediation Guidance" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "src_url": { + "title": "Source URL", + "type": "string" }, "type": { "title": "Type", @@ -2576,97 +2576,54 @@ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, - 8, 99 ], "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", + "title": "Package UID", "type": "string" }, - "uri": { - "title": "File URI", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, "version": { "title": "Version", "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, "required": [ "name", - "type_id" + "version" ], - "title": "File", + "title": "Affected Software Package", "type": "object" }, - "fingerprint": { + "cis_control": { "additionalProperties": false, "properties": { - "algorithm": { - "title": "Algorithm", + "desc": { + "title": "Description", "type": "string" }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "value": { - "title": "Value", + "version": { + "title": "Version", "type": "string" } }, "required": [ - "algorithm_id", - "value" + "name" ], - "title": "Fingerprint", + "title": "CIS Control", "type": "object" }, - "firewall_rule": { + "analytic": { "additionalProperties": false, "anyOf": [ { @@ -2681,69 +2638,49 @@ } ], "properties": { - "category": { - "title": "Category", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "condition": { - "title": "Condition", + "category": { + "title": "Category", "type": "string" }, "desc": { "title": "Description", "type": "string" }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "name": { + "title": "Name", + "type": "string" }, - "match_details": { + "related_analytics": { "items": { - "type": "string" + "$ref": "#/$defs/analytic" }, - "title": "Match Details", + "title": "Related Analytics", "type": "array" }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", + "state": { + "title": "State", "type": "string" }, - "rate_limit": { - "title": "Rate Limit", + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "State ID", "type": "integer" }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { + "type_id": { "enum": [ 0, 1, @@ -2753,549 +2690,646 @@ 5, 6, 7, + 8, + 9, + 10, + 11, 99 ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", + "title": "Type ID", "type": "integer" }, - "model": { - "title": "Model", + "uid": { + "title": "Unique ID", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", + "version": { + "title": "Version", "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" } }, - "title": "GPU Information", + "required": [ + "type_id" + ], + "title": "Analytic", "type": "object" }, - "group": { + "actor": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "app_name" ] }, { "required": [ - "uid" + "app_uid" + ] + }, + { + "required": [ + "invoked_by" + ] + }, + { + "required": [ + "process" + ] + }, + { + "required": [ + "session" + ] + }, + { + "required": [ + "user" ] } ], "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", + "app_name": { + "title": "Application Name", "type": "string" }, - "name": { - "title": "Name", + "app_uid": { + "title": "Application ID", "type": "string" }, - "privileges": { + "authorizations": { "items": { - "type": "string" + "$ref": "#/$defs/authorization" }, - "title": "Privileges", + "title": "Authorization Information", "type": "array" }, - "type": { - "title": "Group Type", - "type": "string" + "idp": { + "$ref": "#/$defs/idp", + "title": "Identity Provider" }, - "uid": { - "title": "Unique ID", + "invoked_by": { + "title": "Invoked by", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" + "process": { + "$ref": "#/$defs/process", + "title": "Process" + }, + "session": { + "$ref": "#/$defs/session", + "title": "Session" + }, + "user": { + "$ref": "#/$defs/user", + "title": "User" } }, - "title": "Group", + "title": "Actor", "type": "object" }, - "http_cookie": { + "cloud": { "additionalProperties": false, "properties": { - "domain": { - "title": "Domain", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "http_only": { - "title": "HTTP Only", - "type": "boolean" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "is_http_only": { - "title": "HTTP Only", - "type": "boolean" + "cloud_partition": { + "title": "Cloud Partition", + "type": "string" }, - "is_secure": { - "title": "Secure", - "type": "boolean" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "name": { - "title": "Name", + "project_uid": { + "title": "Project ID", "type": "string" }, - "path": { - "title": "Path", + "provider": { + "title": "Cloud Provider", "type": "string" }, - "samesite": { - "title": "SameSite", + "region": { + "title": "Region", "type": "string" }, - "secure": { - "title": "Secure", - "type": "boolean" - }, - "value": { - "title": "Value", + "zone": { + "title": "Cloud Availability Zone", "type": "string" } }, "required": [ - "name", - "value" + "provider" ], - "title": "HTTP Cookie", + "title": "Cloud", "type": "object" }, - "http_header": { + "trace": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", - "type": "string" + "duration": { + "title": "Duration Milliseconds", + "type": "integer" }, - "value": { - "title": "Value", + "end_time": { + "title": "End Time", + "type": "integer" + }, + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" + }, + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "span": { + "$ref": "#/$defs/span", + "title": "Span" + }, + "start_time": { + "title": "Start Time", + "type": "integer" + }, + "uid": { + "title": "Unique ID", "type": "string" } }, "required": [ - "name", - "value" + "uid" ], - "title": "HTTP Header", + "title": "Trace", "type": "object" }, - "http_request": { + "file": { "additionalProperties": false, "properties": { - "args": { - "title": "HTTP Arguments", + "parent_folder": { + "title": "Parent Folder", "type": "string" }, - "body_length": { - "title": "Request Body Length", - "type": "integer" + "is_system": { + "title": "System", + "type": "boolean" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" + "xattributes": { + "$ref": "#/$defs/object", + "title": "Extended Attributes" }, - "http_method": { + "confidentiality_id": { "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 ], - "title": "HTTP Method", - "type": "string" - }, - "length": { - "title": "Request Length", + "title": "Confidentiality ID", "type": "integer" }, - "referrer": { - "title": "HTTP Referrer", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", - "type": "string" + "accessor": { + "$ref": "#/$defs/user", + "title": "Accessor" }, - "version": { - "title": "HTTP Version", - "type": "string" + "is_readonly": { + "title": "Read-Only", + "type": "boolean" }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" - } - }, - "title": "HTTP Request", - "type": "object" - }, - "http_response": { - "additionalProperties": false, - "properties": { - "body_length": { - "title": "Response Body Length", + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "code": { - "title": "Response Code", - "type": "integer" + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" }, - "content_type": { - "title": "HTTP Content Type", + "ext": { + "title": "File Extension", "type": "string" }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" + "company_name": { + "title": "Company Name", + "type": "string" }, - "length": { - "title": "Response Length", + "attributes": { + "title": "Attributes", "type": "integer" }, - "message": { - "title": "Message", + "desc": { + "title": "Description", "type": "string" }, - "status": { - "title": "Status", + "type": { + "title": "Type", "type": "string" - } - }, - "required": [ - "code" - ], - "title": "HTTP Response", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" }, - "domain": { - "title": "Domain", + "path": { + "title": "Path", "type": "string" }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" + "uri": { + "title": "File URI", + "type": "string" }, - "has_mfa": { - "title": "MFA Enforced", + "is_deleted": { + "title": "Deleted", "type": "boolean" }, - "issuer": { - "title": "Issuer Details", + "confidentiality": { + "title": "Confidentiality", "type": "string" }, - "name": { - "title": "Name", + "drive_type": { + "title": "Drive Type", "type": "string" }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" + "imported_symbols": { + "items": { + "type": "string" + }, + "title": "Imported Symbols", + "type": "array" }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" + "signature": { + "$ref": "#/$defs/digital_signature", + "title": "Digital Signature" }, - "state": { - "title": "State", + "is_encrypted": { + "title": "Encrypted", + "type": "boolean" + }, + "name": { + "title": "Name", "type": "string" }, - "state_id": { + "accessed_time": { + "title": "Accessed Time", + "type": "integer" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "type_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, + 7, + 8, 99 ], - "title": "State ID", + "title": "Type ID", "type": "integer" }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" + "url": { + "$ref": "#/$defs/url", + "title": "URL" }, - "uid": { - "title": "Unique ID", - "type": "string" + "size": { + "title": "Size", + "type": "integer" }, - "url_string": { - "title": "Configuration URL", + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "internal_name": { + "title": "Internal Name", "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { + }, + "hashes": { "items": { - "type": "string" + "$ref": "#/$defs/fingerprint" }, - "title": "Labels", + "title": "Hashes", "type": "array" }, - "name": { - "title": "Name", + "drive_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Drive Type ID", + "type": "integer" + }, + "security_descriptor": { + "title": "Security Descriptor", "type": "string" }, - "path": { - "title": "Path", + "volume": { + "title": "Volume", "type": "string" }, - "tag": { - "title": "Image Tag", + "modifier": { + "$ref": "#/$defs/user", + "title": "Modifier" + }, + "mime_type": { + "title": "MIME type", "type": "string" }, - "tags": { + "encryption_details": { + "$ref": "#/$defs/encryption_details", + "title": "Encryption Details" + }, + "signatures": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/digital_signature" }, - "title": "Tags", + "title": "Digital Signatures", "type": "array" }, - "uid": { - "title": "Unique ID", + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" } }, "required": [ - "uid" + "name", + "type_id" ], - "title": "Image", + "title": "File", "type": "object" }, - "ja4_fingerprint": { + "remediation": { "additionalProperties": false, "properties": { - "section_a": { - "title": "JA4 Section A", - "type": "string" + "cis_controls": { + "items": { + "$ref": "#/$defs/cis_control" + }, + "title": "CIS Controls", + "type": "array" }, - "section_b": { - "title": "JA4 Section B", + "desc": { + "title": "Description", "type": "string" }, - "section_c": { - "title": "JA4 Section C", - "type": "string" - }, - "section_d": { - "title": "JA4 Section D", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" + "kb_article_list": { + "items": { + "$ref": "#/$defs/kb_article" + }, + "title": "Knowledgebase Articles", + "type": "array" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" + "kb_articles": { + "items": { + "type": "string" + }, + "title": "Knowledgebase Articles", + "type": "array" }, - "value": { - "title": "Value", - "type": "string" + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" } }, "required": [ - "type_id", - "value" + "desc" ], - "title": "JA4+ Fingerprint", + "title": "Remediation", "type": "object" }, - "kb_article": { + "email": { "additionalProperties": false, "anyOf": [ { "required": [ - "src_url" + "from" ] }, { "required": [ - "uid" + "to" ] } ], "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" + "cc": { + "items": { + "type": "string" + }, + "title": "Cc", + "type": "array" }, - "bulletin": { - "title": "Patch Bulletin", + "cc_mailboxes": { + "items": { + "type": "string" + }, + "title": "Cc Mailboxes", + "type": "array" + }, + "delivered_to": { + "title": "Delivered To", "type": "string" }, - "classification": { - "title": "Classification", + "delivered_to_list": { + "items": { + "type": "string" + }, + "title": "Delivered To List", + "type": "array" + }, + "files": { + "items": { + "$ref": "#/$defs/file" + }, + "title": "Files", + "type": "array" + }, + "from": { + "title": "From", "type": "string" }, - "created_time": { - "title": "Created Time", - "type": "integer" + "from_list": { + "items": { + "type": "string" + }, + "title": "From List", + "type": "array" }, - "install_state": { - "title": "Install State", + "from_mailbox": { + "title": "From Mailbox", "type": "string" }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" + "from_mailboxes": { + "items": { + "type": "string" + }, + "title": "From Mailboxes", + "type": "array" }, - "is_superseded": { - "title": "The patch is superseded.", + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" + }, + "is_read": { + "title": "Read", "type": "boolean" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "message_uid": { + "title": "Message UID", + "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" + "raw_header": { + "title": "Raw Header", + "type": "string" }, - "severity": { - "title": "Severity", + "reply_to": { + "title": "Reply To", + "type": "string" + }, + "reply_to_list": { + "items": { + "type": "string" + }, + "title": "Reply To List", + "type": "array" + }, + "reply_to_mailboxes": { + "items": { + "type": "string" + }, + "title": "Reply To Mailboxes", + "type": "array" + }, + "return_path": { + "title": "Return Path", + "type": "string" + }, + "sender": { + "title": "Sender", + "type": "string" + }, + "sender_mailbox": { + "title": "Sender Mailbox", "type": "string" }, "size": { "title": "Size", "type": "integer" }, - "src_url": { - "title": "Source URL", + "smtp_from": { + "title": "SMTP From", "type": "string" }, - "title": { - "title": "Title", + "smtp_to": { + "items": { + "type": "string" + }, + "title": "SMTP To", + "type": "array" + }, + "subject": { + "title": "Subject", "type": "string" }, + "to": { + "items": { + "type": "string" + }, + "title": "To", + "type": "array" + }, + "to_mailboxes": { + "items": { + "type": "string" + }, + "title": "To Mailboxes", + "type": "array" + }, "uid": { - "title": "Unique ID", + "title": "Email Thread UID", "type": "string" + }, + "urls": { + "items": { + "$ref": "#/$defs/url" + }, + "title": "URLs", + "type": "array" + }, + "x_originating_ip": { + "items": { + "type": "string" + }, + "title": "X-Originating-IP", + "type": "array" } }, - "title": "KB Article", + "title": "Email", "type": "object" }, - "key_value_object": { + "environment_variable": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Environment Variable", + "type": "object" + }, + "technique": { "additionalProperties": false, "anyOf": [ { "required": [ - "value" + "name" ] }, { "required": [ - "values" + "uid" ] } ], @@ -3304,59 +3338,149 @@ "title": "Name", "type": "string" }, - "value": { - "title": "Value", + "src_url": { + "title": "Source URL", "type": "string" }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" + "uid": { + "title": "Unique ID", + "type": "string" } }, - "required": [ - "name" - ], - "title": "Key:Value object", + "title": "MITRE Technique", "type": "object" }, - "keyboard_info": { + "http_request": { "additionalProperties": false, "properties": { - "function_keys": { - "title": "Function Keys", + "args": { + "title": "HTTP Arguments", + "type": "string" + }, + "body_length": { + "title": "Request Body Length", "type": "integer" }, - "ime": { - "title": "IME", - "type": "string" + "http_headers": { + "items": { + "$ref": "#/$defs/http_header" + }, + "title": "HTTP Headers", + "type": "array" }, - "keyboard_layout": { - "title": "Keyboard Layout", + "http_method": { + "enum": [ + "CONNECT", + "DELETE", + "GET", + "HEAD", + "OPTIONS", + "PATCH", + "POST", + "PUT", + "TRACE" + ], + "title": "HTTP Method", "type": "string" }, - "keyboard_subtype": { - "title": "Keyboard Subtype", + "length": { + "title": "Request Length", "type": "integer" }, - "keyboard_type": { - "title": "Keyboard Type", + "referrer": { + "title": "HTTP Referrer", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "url": { + "$ref": "#/$defs/url", + "title": "URL" + }, + "user_agent": { + "title": "HTTP User-Agent", "type": "string" + }, + "version": { + "title": "HTTP Version", + "type": "string" + }, + "x_forwarded_for": { + "items": { + "type": "string" + }, + "title": "X-Forwarded-For", + "type": "array" } }, - "title": "Keyboard Information", + "title": "HTTP Request", "type": "object" }, - "kill_chain_phase": { + "cvss": { "additionalProperties": false, "properties": { - "phase": { - "title": "Kill Chain Phase", + "base_score": { + "title": "Base Score", + "type": "number" + }, + "depth": { + "enum": [ + "Base", + "Environmental", + "Temporal" + ], + "title": "CVSS Depth", "type": "string" }, - "phase_id": { + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" + }, + "overall_score": { + "title": "Overall Score", + "type": "number" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "src_url": { + "title": "Source URL", + "type": "string" + }, + "vector_string": { + "title": "Vector String", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "base_score", + "version" + ], + "title": "CVSS Score", + "type": "object" + }, + "fingerprint": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Algorithm", + "type": "string" + }, + "algorithm_id": { "enum": [ 0, 1, @@ -3366,298 +3490,356 @@ 5, 6, 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, 99 ], - "title": "Kill Chain Phase ID", + "title": "Algorithm ID", "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "phase_id" + "algorithm_id", + "value" ], - "title": "Kill Chain Phase", + "title": "Fingerprint", "type": "object" }, - "ldap_person": { + "process_entity": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "cmd_line" + ] + }, + { + "required": [ + "cpid" + ] + }, + { + "required": [ + "name" + ] + }, + { + "required": [ + "path" + ] + }, + { + "required": [ + "pid" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "cost_center": { - "title": "Cost Center", + "cmd_line": { + "title": "Command Line", + "type": "string" + }, + "cpid": { + "title": "Common Process Identifier", "type": "string" }, "created_time": { "title": "Created Time", "type": "integer" }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", + "name": { + "title": "Name", "type": "string" }, - "display_name": { - "title": "Display Name", + "path": { + "title": "Path", "type": "string" }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" + "pid": { + "title": "Process ID", + "type": "integer" }, - "employee_uid": { - "title": "Employee ID", + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "Process Entity", + "type": "object" + }, + "observable": { + "additionalProperties": false, + "properties": { + "event_uid": { + "title": "Event UID", "type": "string" }, - "given_name": { - "title": "Given Name", + "name": { + "title": "Name", "type": "string" }, - "hire_time": { - "title": "Hire Time", - "type": "integer" + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" }, - "job_title": { - "title": "Job Title", + "type": { + "title": "Type", "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 28, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 39, + 40, + 41, + 42, + 43, + 44, + 45, + 46, + 47, + 48, + 99 + ], + "title": "Type ID", "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", + "type_uid": { + "title": "Type ID", "type": "integer" }, - "office_location": { - "title": "Office Location", + "value": { + "title": "Value", "type": "string" - }, - "phone_number": { - "title": "Telephone Number", + } + }, + "required": [ + "type_id" + ], + "title": "Observable", + "type": "object" + }, + "http_header": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", "type": "string" }, - "surname": { - "title": "Surname", + "value": { + "title": "Value", "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" } }, - "title": "LDAP Person", + "required": [ + "name", + "value" + ], + "title": "HTTP Header", "type": "object" }, - "load_balancer": { + "attack": { "additionalProperties": false, "anyOf": [ { "required": [ - "name" + "sub_technique" ] }, { "required": [ - "uid" + "tactic" + ] + }, + { + "required": [ + "technique" ] } ], "properties": { - "classification": { - "title": "Classification", - "type": "string" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "endpoint_connections": { - "items": { - "$ref": "#/$defs/endpoint_connection" - }, - "title": "Endpoint Connections", - "type": "array" - }, - "error_message": { - "title": "Error Message", - "type": "string" + "mitigation": { + "$ref": "#/$defs/mitigation", + "title": "MITRE Mitigation" }, - "ip": { - "title": "IP Address", - "type": "string" + "sub_technique": { + "$ref": "#/$defs/sub_technique", + "title": "MITRE Sub-technique" }, - "message": { - "title": "Message", - "type": "string" + "tactic": { + "$ref": "#/$defs/tactic", + "title": "MITRE Tactic" }, - "metrics": { + "tactics": { "items": { - "$ref": "#/$defs/metric" + "$ref": "#/$defs/tactic" }, - "title": "Metrics", + "title": "Tactics", "type": "array" }, - "name": { - "title": "Name", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" + "technique": { + "$ref": "#/$defs/technique", + "title": "MITRE Technique" }, - "uid": { - "title": "Unique ID", + "version": { + "title": "Version", "type": "string" } }, - "title": "Load Balancer", + "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", "type": "object" }, - "location": { + "network_interface": { "additionalProperties": false, "anyOf": [ { "required": [ - "city" + "hostname" ] }, { "required": [ - "country" + "ip" ] }, { "required": [ - "postal_code" + "mac" ] }, { "required": [ - "region" + "name" + ] + }, + { + "required": [ + "uid" ] } ], "properties": { - "aerial_height": { - "title": "Aerial Height", + "hostname": { + "title": "Hostname", "type": "string" }, - "city": { - "title": "City", + "ip": { + "title": "IP Address", "type": "string" }, - "continent": { - "title": "Continent", + "mac": { + "title": "MAC Address", "type": "string" }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", + "name": { + "title": "Name", "type": "string" }, - "desc": { - "title": "Description", + "namespace": { + "title": "Namespace", "type": "string" }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" + "open_ports": { + "items": { + "$ref": "#/$defs/port_info" + }, + "title": "Open Ports", + "type": "array" }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" + "subnet_prefix": { + "title": "Subnet Prefix Length", + "type": "integer" }, - "geohash": { - "title": "Geohash", + "type": { + "title": "Type", "type": "string" }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Type ID", + "type": "integer" }, - "region": { - "title": "Region", + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Geo Location", + "title": "Network Interface", "type": "object" }, - "logger": { + "user": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "account" + ] + }, { "required": [ "name" @@ -3670,253 +3852,132 @@ } ], "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" + "account": { + "$ref": "#/$defs/account", + "title": "Account" }, - "log_level": { - "title": "Log Level", + "credential_uid": { + "title": "User Credential ID", "type": "string" }, - "log_name": { - "title": "Log Name", + "display_name": { + "title": "Display Name", "type": "string" }, - "log_provider": { - "title": "Log Provider", + "domain": { + "title": "Domain", "type": "string" }, - "log_version": { - "title": "Log Version", + "email_addr": { + "title": "Email Address", "type": "string" }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", + "forward_addr": { + "title": "Forwarding Address", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "full_name": { + "title": "Full Name", "type": "string" }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", + "has_mfa": { + "title": "MFA Assigned", "type": "boolean" }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" + "ldap_person": { + "$ref": "#/$defs/ldap_person", + "title": "LDAP Person" }, - "value": { - "title": "Value", + "name": { + "title": "Name", "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" + "phone_number": { + "title": "Telephone Number", + "type": "string" }, - "files": { + "programmatic_credentials": { "items": { - "$ref": "#/$defs/file" + "$ref": "#/$defs/programmatic_credential" }, - "title": "Files", + "title": "Programmatic Credentials", "type": "array" }, - "name": { - "title": "Name", + "risk_level": { + "title": "Risk Level", "type": "string" }, - "num_infected": { - "title": "Number of Infected Entities", + "risk_level_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Risk Level ID", "type": "integer" }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" + "risk_score": { + "title": "Risk Score", + "type": "integer" }, - "severity": { - "title": "Severity", + "type": { + "title": "Type", "type": "string" }, - "severity_id": { + "type_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, 99 ], - "title": "Severity ID", + "title": "Type ID", "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", + "type": "string" } }, - "required": [ - "classification_ids" - ], - "title": "Malware", + "title": "User", "type": "object" }, - "malware_scan_info": { + "auth_factor": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "end_time": { - "title": "End Time", - "type": "integer" + "device": { + "$ref": "#/$defs/device", + "title": "Device" }, - "name": { - "title": "Name", + "email_addr": { + "title": "Email Address", "type": "string" }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", + "factor_type": { + "title": "Factor Type", "type": "string" }, - "type_id": { + "factor_type_id": { "enum": [ 0, 1, @@ -3926,255 +3987,199 @@ 5, 6, 7, + 8, + 9, + 10, + 11, 99 ], - "title": "Type ID", + "title": "Factor Type ID", "type": "integer" }, - "uid": { - "title": "Scan UID", + "is_hotp": { + "title": "HMAC-based One-time Password (HOTP)", + "type": "boolean" + }, + "is_totp": { + "title": "Time-based One-time Password (TOTP)", + "type": "boolean" + }, + "phone_number": { + "title": "Phone Number", "type": "string" }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" + "provider": { + "title": "Provider", + "type": "string" + }, + "security_questions": { + "items": { + "type": "string" + }, + "title": "Security Questions", + "type": "array" } }, "required": [ - "type_id" + "factor_type_id" ], - "title": "Malware Scan Info", + "title": "Authentication Factor", "type": "object" }, - "metadata": { + "osint": { "additionalProperties": false, "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { + "references": { "items": { "type": "string" }, - "title": "Debug Information", + "title": "References", "type": "array" }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" + "email_auth": { + "$ref": "#/$defs/email_auth", + "title": "Related Email Authentication" }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" + "external_uid": { + "title": "External ID", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "tlp": { + "enum": [ + "AMBER", + "AMBER STRICT", + "CLEAR", + "GREEN", + "RED", + "WHITE" + ], + "title": "Traffic Light Protocol", + "type": "string" }, - "log_format": { - "title": "Log Source Format", + "detection_pattern": { + "title": "Detection Pattern", "type": "string" }, - "log_level": { - "title": "Log Level", + "uid": { + "title": "Unique ID", "type": "string" }, - "log_name": { - "title": "Log Name", + "category": { + "title": "Category", "type": "string" }, - "log_provider": { - "title": "Log Provider", + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "creator": { + "$ref": "#/$defs/user", + "title": "Creator" + }, + "desc": { + "title": "Description", "type": "string" }, - "log_source": { - "title": "Log Source", + "subdomains": { + "items": { + "type": "string" + }, + "title": "Related Subdomains", + "type": "array" + }, + "confidence": { + "title": "Confidence", "type": "string" }, - "log_version": { - "title": "Log Version", + "reputation": { + "$ref": "#/$defs/reputation", + "title": "Reputation Scores" + }, + "type": { + "title": "Type", "type": "string" }, - "logged_time": { - "title": "Logged Time", + "uploaded_time": { + "title": "Uploaded Time", "type": "integer" }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" }, - "modified_time": { - "title": "Modified Time", + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "original_event_uid": { - "title": "Original Event ID", + "comment": { + "title": "Analyst Comments", "type": "string" }, - "original_time": { - "title": "Original Time", + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "value": { + "title": "Indicator", "type": "string" }, - "processed_time": { - "title": "Processed Time", + "created_time": { + "title": "Created Time", "type": "integer" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { + "intrusion_sets": { "items": { "type": "string" }, - "title": "Profiles", + "title": "Intrusion Sets", "type": "array" }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" + "script": { + "$ref": "#/$defs/script", + "title": "Related Script Data" }, - "source": { - "title": "Source", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "tags": { + "attacks": { "items": { - "$ref": "#/$defs/key_value_object" + "$ref": "#/$defs/attack" }, - "title": "Tags", + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", "type": "array" }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { + "related_analytics": { "items": { - "$ref": "#/$defs/transformation_info" + "$ref": "#/$defs/analytic" }, - "title": "Transformation Info", + "title": "Related Analytics", "type": "array" }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" + "file": { + "$ref": "#/$defs/file", + "title": "Related File" }, - "untruncated_size": { - "title": "Untruncated Size", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { "name": { "title": "Name", "type": "string" }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] + "email": { + "$ref": "#/$defs/email", + "title": "Related Email" }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { + "kill_chain": { "items": { - "$ref": "#/$defs/d3fend" + "$ref": "#/$defs/kill_chain_phase" }, - "title": "Countermeasures", + "title": "Kill Chain", "type": "array" }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_connection_info": { - "additionalProperties": false, - "properties": { - "boundary": { - "title": "Boundary", - "type": "string" - }, - "boundary_id": { + "detection_pattern_type_id": { "enum": [ 0, 1, @@ -4183,256 +4188,387 @@ 4, 5, 6, - 7, - 8, - 9, - 10, - 11, 99 ], - "title": "Boundary ID", + "title": "Detection Pattern Type ID", "type": "integer" }, - "community_uid": { - "title": "Community ID", + "detection_pattern_type": { + "title": "Detection Pattern", "type": "string" }, - "direction": { - "title": "Direction", - "type": "string" + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, - "direction_id": { + "threat_actor": { + "$ref": "#/$defs/threat_actor", + "title": "Threat Actor" + }, + "type_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, 99 ], - "title": "Direction ID", + "title": "Indicator Type ID", "type": "integer" }, - "flag_history": { - "title": "Connection Flag History", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, - "protocol_name": { - "title": "Protocol Name", + "answers": { + "items": { + "$ref": "#/$defs/dns_answer" + }, + "title": "Related DNS Answers", + "type": "array" + }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "severity": { + "title": "Severity", "type": "string" }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" + "campaign": { + "$ref": "#/$defs/campaign", + "title": "Campaign" }, - "protocol_ver": { - "title": "IP Version", + "src_url": { + "title": "Source URL", "type": "string" }, - "protocol_ver_id": { + "severity_id": { "enum": [ 0, + 1, + 2, + 3, 4, + 5, 6, 99 ], - "title": "IP Version ID", + "title": "Severity ID", "type": "integer" }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" + "subnet": { + "title": "Related Subnet", + "type": "string" }, - "tcp_flags": { - "title": "TCP Flags", - "type": "integer" + "signatures": { + "items": { + "$ref": "#/$defs/digital_signature" + }, + "title": "Related Digital Signatures", + "type": "array" }, - "uid": { - "title": "Connection UID", + "whois": { + "$ref": "#/$defs/whois", + "title": "WHOIS" + }, + "vulnerabilities": { + "items": { + "$ref": "#/$defs/vulnerability" + }, + "title": "Related Vulnerabilities", + "type": "array" + } + }, + "required": [ + "type_id", + "value" + ], + "title": "OSINT", + "type": "object" + }, + "san": { + "additionalProperties": false, + "properties": { + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", "type": "string" } }, "required": [ - "direction_id" + "name", + "type" ], - "title": "Network Connection Information", + "title": "Subject Alternative Name", "type": "object" }, - "network_endpoint": { + "occurrence_details": { "additionalProperties": false, "anyOf": [ { "required": [ - "domain" + "cell_name" ] }, { "required": [ - "hostname" + "column_name" ] }, { "required": [ - "instance_uid" + "column_number" ] }, { "required": [ - "interface_name" + "end_line" ] }, { "required": [ - "interface_uid" + "json_path" ] }, { "required": [ - "ip" + "page_number" ] }, { "required": [ - "name" + "record_index_in_array" ] }, { "required": [ - "svc_name" + "row_number" ] }, { "required": [ - "uid" + "start_line" ] } ], "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" + "cell_name": { + "title": "Cell Name", + "type": "string" }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" + "column_name": { + "title": "Column Name", + "type": "string" }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + "column_number": { + "title": "Column Number", + "type": "integer" }, - "domain": { - "title": "Domain", + "end_line": { + "title": "End Line", + "type": "integer" + }, + "json_path": { + "title": "JSON Path", "type": "string" }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" + "page_number": { + "title": "Page Number", + "type": "integer" }, - "hostname": { - "title": "Hostname", - "type": "string" + "record_index_in_array": { + "title": "Record Index in Array", + "type": "integer" }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" + "row_number": { + "title": "Row Number", + "type": "integer" }, - "instance_uid": { - "title": "Instance ID", + "start_line": { + "title": "Start Line", + "type": "integer" + } + }, + "title": "Occurrence Details", + "type": "object" + }, + "firewall_rule": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "category": { + "title": "Category", "type": "string" }, - "interface_name": { - "title": "Network Interface Name", + "condition": { + "title": "Condition", "type": "string" }, - "interface_uid": { - "title": "Network Interface ID", + "desc": { + "title": "Description", "type": "string" }, - "intermediate_ips": { + "duration": { + "title": "Duration Milliseconds", + "type": "integer" + }, + "match_details": { "items": { "type": "string" }, - "title": "Intermediate IP Addresses", + "title": "Match Details", "type": "array" }, - "ip": { - "title": "IP Address", + "match_location": { + "title": "Match Location", "type": "string" }, - "isp": { - "title": "ISP Name", + "name": { + "title": "Name", "type": "string" }, - "isp_org": { - "title": "ISP Org", - "type": "string" + "rate_limit": { + "title": "Rate Limit", + "type": "integer" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + "sensitivity": { + "title": "Sensitivity", + "type": "string" }, - "mac": { - "title": "MAC Address", + "type": { + "title": "Type", "type": "string" }, - "mac_vendor": { - "title": "MAC Vendor", + "uid": { + "title": "Unique ID", "type": "string" }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Firewall Rule", + "type": "object" + }, + "threat_actor": { + "additionalProperties": false, + "properties": { "name": { "title": "Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_scope": { - "title": "Network Scope", + "type": { + "title": "Threat Actor Type", "type": "string" }, - "network_scope_id": { + "type_id": { "enum": [ 0, 1, 2, + 3, + 4, 99 ], - "title": "Network Scope ID", + "title": "Threat Actor Type ID", "type": "integer" + } + }, + "required": [ + "name" + ], + "title": "Threat Actor", + "type": "object" + }, + "package": { + "additionalProperties": false, + "properties": { + "architecture": { + "title": "Architecture", + "type": "string" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" + "epoch": { + "title": "Epoch", + "type": "integer" }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "port": { - "title": "Port", - "type": "integer" + "license": { + "title": "Software License", + "type": "string" }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" + "license_url": { + "title": "Software License URL", + "type": "string" }, - "subnet_uid": { - "title": "Subnet UID", + "name": { + "title": "Name", "type": "string" }, - "svc_name": { - "title": "Service Name", + "package_manager": { + "title": "Package Manager", + "type": "string" + }, + "package_manager_url": { + "title": "Package Manager URL", + "type": "string" + }, + "purl": { + "title": "Package URL", + "type": "string" + }, + "release": { + "title": "Software Release Details", + "type": "string" + }, + "src_url": { + "title": "Source URL", "type": "string" }, "type": { @@ -4444,172 +4580,117 @@ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], "title": "Type ID", "type": "integer" }, "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", + "title": "Package UID", "type": "string" }, - "vpc_uid": { - "title": "VPC UID", + "vendor_name": { + "title": "Vendor Name", "type": "string" }, - "zone": { - "title": "Network Zone", + "version": { + "title": "Version", "type": "string" } }, - "title": "Network Endpoint", + "required": [ + "name", + "version" + ], + "title": "Software Package", "type": "object" }, - "network_interface": { + "packet": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", + "encoding": { + "title": "Encoding", "type": "string" }, - "mac": { - "title": "MAC Address", - "type": "string" + "encoding_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Encoding ID", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "end_offset": { + "title": "End Offset", + "type": "integer" }, - "namespace": { - "title": "Namespace", + "format": { + "title": "Format", "type": "string" }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" + "format_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Format ID", + "type": "integer" }, - "subnet_prefix": { - "title": "Subnet Prefix Length", + "sequence_number": { + "title": "Sequence Number", "type": "integer" }, - "type": { - "title": "Type", + "source": { + "title": "Source", "type": "string" }, - "type_id": { + "source_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, + 7, 99 ], - "title": "Type ID", + "title": "Source ID", "type": "integer" }, - "uid": { - "title": "Unique ID", + "start_offset": { + "title": "Start Offset", + "type": "integer" + }, + "value": { + "title": "Value", "type": "string" } }, - "title": "Network Interface", + "required": [ + "value" + ], + "title": "Packet", "type": "object" }, - "network_proxy": { + "transformation_info": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, { "required": [ "name" ] }, - { - "required": [ - "svc_name" - ] - }, { "required": [ "uid" @@ -4617,426 +4698,215 @@ } ], "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", + "lang": { + "title": "Language", "type": "string" }, - "isp_org": { - "title": "ISP Org", + "name": { + "title": "Name", "type": "string" }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "mac": { - "title": "MAC Address", - "type": "string" + "time": { + "title": "Event Time", + "type": "integer" }, - "mac_vendor": { - "title": "MAC Vendor", + "uid": { + "title": "Unique ID", "type": "string" }, - "name": { - "title": "Name", + "url_string": { + "title": "URL String", "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_scope": { - "title": "Network Scope", + } + }, + "title": "Transformation Info", + "type": "object" + }, + "network_connection_info": { + "additionalProperties": false, + "properties": { + "boundary": { + "title": "Boundary", "type": "string" }, - "network_scope_id": { + "boundary_id": { "enum": [ 0, 1, 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, 99 ], - "title": "Network Scope ID", + "title": "Boundary ID", "type": "integer" }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" + "community_uid": { + "title": "Community ID", + "type": "string" }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", + "direction": { + "title": "Direction", "type": "string" }, - "type_id": { + "direction_id": { "enum": [ 0, 1, 2, 3, 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, 99 ], - "title": "Type ID", + "title": "Direction ID", "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", + "flag_history": { + "title": "Connection Flag History", "type": "string" }, - "zone": { - "title": "Network Zone", + "protocol_name": { + "title": "Protocol Name", "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "network_traffic": { - "additionalProperties": false, - "properties": { - "bytes": { - "title": "Total Bytes", - "type": "integer" - }, - "bytes_in": { - "title": "Bytes In", - "type": "integer" - }, - "bytes_missed": { - "title": "Bytes Missed", - "type": "integer" - }, - "bytes_out": { - "title": "Bytes Out", - "type": "integer" - }, - "chunks": { - "title": "Chunks", - "type": "integer" - }, - "chunks_in": { - "title": "Chunks In", - "type": "integer" - }, - "chunks_out": { - "title": "Chunks Out", - "type": "integer" }, - "end_time": { - "title": "End Time", + "protocol_num": { + "title": "Protocol Number", "type": "integer" }, - "packets": { - "title": "Total Packets", - "type": "integer" + "protocol_ver": { + "title": "IP Version", + "type": "string" }, - "packets_in": { - "title": "Packets In", + "protocol_ver_id": { + "enum": [ + 0, + 4, + 6, + 99 + ], + "title": "IP Version ID", "type": "integer" }, - "packets_out": { - "title": "Packets Out", - "type": "integer" + "session": { + "$ref": "#/$defs/session", + "title": "Session" }, - "start_time": { - "title": "Start Time", + "tcp_flags": { + "title": "TCP Flags", "type": "integer" }, - "timespan": { - "$ref": "#/$defs/timespan", - "title": "Time Span" + "uid": { + "title": "Connection UID", + "type": "string" } }, - "title": "Network Traffic", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", + "required": [ + "direction_id" + ], + "title": "Network Connection Information", "type": "object" }, - "observable": { + "response": { "additionalProperties": false, "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" + "code": { + "title": "Response Code", + "type": "integer" }, - "name": { - "title": "Name", - "type": "string" + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" + "data": { + "title": "Data" }, - "type": { - "title": "Type", + "error": { + "title": "Error Code", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" + "error_message": { + "title": "Error Message", + "type": "string" }, - "type_uid": { - "title": "Type ID", - "type": "integer" + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" }, - "value": { - "title": "Value", + "message": { + "title": "Message", "type": "string" } }, - "required": [ - "type_id" - ], - "title": "Observable", + "title": "Response Elements", "type": "object" }, - "occurrence_details": { + "reporter": { "additionalProperties": false, "anyOf": [ { "required": [ - "cell_name" + "hostname" ] }, { "required": [ - "column_name" + "ip" ] }, { "required": [ - "column_number" + "name" ] }, { "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" + "uid" ] } ], "properties": { - "cell_name": { - "title": "Cell Name", + "hostname": { + "title": "Hostname", "type": "string" }, - "column_name": { - "title": "Column Name", + "ip": { + "title": "IP Address", "type": "string" }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", + "name": { + "title": "Name", "type": "string" }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" }, - "start_line": { - "title": "Start Line", - "type": "integer" + "uid": { + "title": "Unique ID", + "type": "string" } }, - "title": "Occurrence Details", + "title": "Reporter", "type": "object" }, - "organization": { + "load_balancer": { "additionalProperties": false, "anyOf": [ { @@ -5051,459 +4921,245 @@ } ], "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", + "classification": { + "title": "Classification", "type": "string" }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" + "code": { + "title": "Response Code", + "type": "integer" }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" }, - "country": { - "title": "Country", - "type": "string" + "endpoint_connections": { + "items": { + "$ref": "#/$defs/endpoint_connection" + }, + "title": "Endpoint Connections", + "type": "array" }, - "cpe_name": { - "title": "The product CPE identifier", + "error_message": { + "title": "Error Message", "type": "string" }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", + "ip": { + "title": "IP Address", "type": "string" }, - "kernel_release": { - "title": "Kernel Release", + "message": { + "title": "Message", "type": "string" }, - "lang": { - "title": "Language", - "type": "string" + "metrics": { + "items": { + "$ref": "#/$defs/metric" + }, + "title": "Metrics", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", + "status_detail": { + "title": "Status Detail", "type": "string" }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", + "uid": { + "title": "Unique ID", "type": "string" } }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", + "title": "Load Balancer", "type": "object" }, - "osint": { + "url": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "path" + ] + }, + { + "required": [ + "url_string" + ] + } + ], "properties": { - "answers": { + "categories": { "items": { - "$ref": "#/$defs/dns_answer" + "type": "string" }, - "title": "Related DNS Answers", + "title": "Website Categorization", "type": "array" }, - "attacks": { + "category_ids": { "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" + "enum": [ + 0, + 1, + 3, + 4, + 5, + 6, + 7, + 9, + 11, + 14, + 15, + 16, + 17, + 18, + 20, + 21, + 22, + 23, + 24, + 25, + 26, + 27, + 29, + 30, + 31, + 32, + 33, + 34, + 35, + 36, + 37, + 38, + 40, + 43, + 44, + 45, + 46, + 47, + 49, + 50, + 51, + 52, + 53, + 54, + 55, + 56, + 57, + 58, + 59, + 60, + 61, + 63, + 64, + 65, + 66, + 67, + 68, + 71, + 83, + 84, + 85, + 86, + 87, + 88, + 89, + 90, + 92, + 93, + 95, + 96, + 97, + 98, + 99, + 101, + 102, + 103, + 106, + 107, + 108, + 109, + 110, + 111, + 112, + 113, + 114, + 118, + 121 + ], + "type": "integer" }, - "title": "Related Analytics", + "title": "Website Categorization IDs", "type": "array" }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", + "domain": { + "title": "Domain", "type": "string" }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", + "hostname": { + "title": "Hostname", "type": "string" }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", + "path": { + "title": "Path", "type": "string" }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" + "port": { + "title": "Port", + "type": "integer" }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", + "query_string": { + "title": "HTTP Query String", "type": "string" }, - "type": { - "title": "Type", + "resource_type": { + "title": "Resource Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", + "scheme": { + "title": "Scheme", "type": "string" }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", + "subdomain": { + "title": "Subdomain", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "url_string": { + "title": "URL String", "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" } }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", + "title": "Uniform Resource Locator", "type": "object" }, - "package": { + "object": { + "additionalProperties": true, + "properties": {}, + "title": "Object", + "type": "object" + }, + "extension": { "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, - "uid": { - "title": "Package UID", + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Name", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "uid": { + "title": "Unique ID", "type": "string" }, "version": { @@ -5512,39 +5168,19 @@ } }, "required": [ - "name", "version" ], - "title": "Software Package", + "title": "Schema Extension", "type": "object" }, - "packet": { + "gpu_info": { "additionalProperties": false, "properties": { - "encoding": { - "title": "Encoding", - "type": "string" - }, - "encoding_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Encoding ID", - "type": "integer" - }, - "end_offset": { - "title": "End Offset", - "type": "integer" - }, - "format": { - "title": "Format", + "bus_type": { + "title": "Bus Type", "type": "string" }, - "format_id": { + "bus_type_id": { "enum": [ 0, 1, @@ -5553,102 +5189,44 @@ 4, 5, 6, + 7, 99 ], - "title": "Format ID", + "title": "Bus Type ID", "type": "integer" }, - "sequence_number": { - "title": "Sequence Number", + "cores": { + "title": "Cores", "type": "integer" }, - "source": { - "title": "Source", + "model": { + "title": "Model", "type": "string" }, - "source_id": { + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "vram_mode": { + "title": "VRAM Mode", + "type": "string" + }, + "vram_mode_id": { "enum": [ 0, 1, 2, - 3, - 4, - 5, - 6, - 7, 99 ], - "title": "Source ID", + "title": "VRAM Mode ID", "type": "integer" }, - "start_offset": { - "title": "Start Offset", + "vram_size": { + "title": "VRAM Size", "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Packet", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, - "title": "Policy", + "title": "GPU Information", "type": "object" }, "port_info": { @@ -5673,17 +5251,12 @@ "title": "Port Information", "type": "object" }, - "process": { + "service": { "additionalProperties": false, "anyOf": [ { "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" + "name" ] }, { @@ -5693,167 +5266,182 @@ } ], "properties": { - "ancestry": { + "labels": { "items": { - "$ref": "#/$defs/process_entity" + "type": "string" }, - "title": "Ancestry", + "title": "Labels", "type": "array" }, - "cmd_line": { - "title": "Command Line", + "name": { + "title": "Name", "type": "string" }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" }, - "cpid": { - "title": "Common Process Identifier", + "uid": { + "title": "Unique ID", "type": "string" }, - "created_time": { - "title": "Created Time", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Service", + "type": "object" + }, + "tls": { + "additionalProperties": false, + "properties": { + "alert": { + "title": "Client TLS Alert", "type": "integer" }, - "environment_variables": { + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" + }, + "certificate_chain": { "items": { - "$ref": "#/$defs/environment_variable" + "type": "string" }, - "title": "Environment Variables", + "title": "Certificate Chain", "type": "array" }, - "file": { - "$ref": "#/$defs/file", - "title": "File" + "cipher": { + "title": "Cipher Suite", + "type": "string" }, - "hosted_services": { + "client_ciphers": { "items": { - "$ref": "#/$defs/win_win_service" + "type": "string" }, - "title": "Hosted Services", + "title": "Client Cipher Suites", "type": "array" }, - "integrity": { - "title": "Integrity", - "type": "string" + "extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "Extension List", + "type": "array" }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", + "handshake_dur": { + "title": "Handshake Duration", "type": "integer" }, - "lineage": { + "ja3_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3 Hash" + }, + "ja3s_hash": { + "$ref": "#/$defs/fingerprint", + "title": "JA3S Hash" + }, + "key_length": { + "title": "Key Length", + "type": "integer" + }, + "sans": { "items": { - "type": "string" + "$ref": "#/$defs/san" }, - "title": "Lineage", + "title": "Subject Alternative Names", "type": "array" }, - "loaded_modules": { + "server_ciphers": { "items": { "type": "string" }, - "title": "Loaded Modules", + "title": "Server Cipher Suites", + "type": "array" + }, + "sni": { + "title": "Server Name Indication", + "type": "string" + }, + "tls_extension_list": { + "items": { + "$ref": "#/$defs/tls_extension" + }, + "title": "TLS Extension List", "type": "array" }, + "version": { + "title": "Version", + "type": "string" + } + }, + "required": [ + "version" + ], + "title": "Transport Layer Security (TLS)", + "type": "object" + }, + "metric": { + "additionalProperties": false, + "properties": { "name": { "title": "Name", "type": "string" }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", + "value": { + "title": "Value", "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "Metric", + "type": "object" + }, + "request": { + "additionalProperties": false, + "properties": { + "containers": { + "items": { + "$ref": "#/$defs/container" + }, + "title": "Containers", + "type": "array" }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" + "data": { + "title": "Data" }, - "tid": { - "title": "Thread ID", - "type": "integer" + "flags": { + "items": { + "type": "string" + }, + "title": "Flags", + "type": "array" }, "uid": { "title": "Unique ID", "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" } }, - "title": "Process", + "required": [ + "uid" + ], + "title": "Request Elements", "type": "object" }, - "process_entity": { + "sub_technique": { "additionalProperties": false, "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, { "required": [ "name" ] }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, { "required": [ "uid" @@ -5861,39 +5449,23 @@ } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "src_url": { + "title": "Source URL", "type": "string" }, - "pid": { - "title": "Process ID", - "type": "integer" - }, "uid": { "title": "Unique ID", "type": "string" } }, - "title": "Process Entity", + "title": "MITRE Sub-technique", "type": "object" }, - "product": { + "container": { "additionalProperties": false, "anyOf": [ { @@ -5908,175 +5480,294 @@ } ], "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" + "hash": { + "$ref": "#/$defs/fingerprint", + "title": "Hash" }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" + "image": { + "$ref": "#/$defs/image", + "title": "Image" }, - "lang": { - "title": "Language", - "type": "string" + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" }, "name": { "title": "Name", "type": "string" }, - "path": { - "title": "Path", + "network_driver": { + "title": "Network Driver", "type": "string" }, - "uid": { - "title": "Unique ID", + "orchestrator": { + "title": "Orchestrator", "type": "string" }, - "url_string": { - "title": "URL String", + "pod_uuid": { + "title": "Pod UUID", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "runtime": { + "title": "Runtime", "type": "string" }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", + "size": { + "title": "Size", "type": "integer" }, - "type": { - "title": "Type", + "tag": { + "title": "Image Tag", "type": "string" }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, "uid": { "title": "Unique ID", "type": "string" } }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", + "title": "Container", "type": "object" }, - "remediation": { + "malware": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "cis_controls": { + "classification_ids": { "items": { - "$ref": "#/$defs/cis_control" + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 13, + 14, + 15, + 16, + 17, + 18, + 19, + 20, + 21, + 22, + 99 + ], + "type": "integer" }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" + "title": "Classification IDs", + "type": "array" }, - "kb_article_list": { + "classifications": { "items": { - "$ref": "#/$defs/kb_article" + "type": "string" }, - "title": "Knowledgebase Articles", + "title": "Classifications", "type": "array" }, - "kb_articles": { + "cves": { "items": { - "type": "string" + "$ref": "#/$defs/cve" }, - "title": "Knowledgebase Articles", + "title": "CVE List", "type": "array" }, - "references": { + "files": { "items": { - "type": "string" + "$ref": "#/$defs/file" }, - "title": "References", + "title": "Files", "type": "array" + }, + "name": { + "title": "Name", + "type": "string" + }, + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" + }, + "path": { + "title": "Path", + "type": "string" + }, + "provider": { + "title": "Provider", + "type": "string" + }, + "severity": { + "title": "Severity", + "type": "string" + }, + "severity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Severity ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", + "type": "string" } }, "required": [ - "desc" + "classification_ids" ], - "title": "Remediation", + "title": "Malware", "type": "object" }, - "reporter": { + "win_win_service": { "additionalProperties": false, "anyOf": [ { "required": [ - "hostname" + "cmd_line" ] }, { "required": [ - "ip" + "service_category_id" ] }, { "required": [ - "name" + "service_dependencies" ] }, { "required": [ - "uid" + "service_error_control_id" + ] + }, + { + "required": [ + "service_start_name" + ] + }, + { + "required": [ + "service_start_type_id" + ] + }, + { + "required": [ + "service_type_id" ] } ], "properties": { - "hostname": { - "title": "Hostname", + "cmd_line": { + "title": "Command Line", "type": "string" }, - "ip": { - "title": "IP Address", + "hosting_process": { + "$ref": "#/$defs/process_entity", + "title": "Hosting Process" + }, + "labels": { + "items": { + "type": "string" + }, + "title": "Labels", + "type": "array" + }, + "load_order_group": { + "title": "Load Order Group", "type": "string" }, "name": { "title": "Name", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "service_category": { + "title": "Service Category", + "type": "string" }, - "uid": { - "title": "Unique ID", + "service_category_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Service Category ID", + "type": "integer" + }, + "service_dependencies": { + "items": { + "type": "string" + }, + "title": "Service Dependencies", + "type": "array" + }, + "service_dll_file": { + "$ref": "#/$defs/file", + "title": "Service DLL" + }, + "service_error_control": { + "title": "Service Error Control", "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" }, - "provider": { - "title": "Provider", + "service_error_control_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Error Control ID", + "type": "integer" + }, + "service_file": { + "$ref": "#/$defs/file", + "title": "Service File" + }, + "service_start_name": { + "title": "Service Start Name", "type": "string" }, - "score": { - "title": "Reputation Score", + "service_start_type": { + "title": "Service Start Type", "type": "string" }, - "score_id": { + "service_start_type_id": { "enum": [ 0, 1, @@ -6084,98 +5775,127 @@ 3, 4, 5, - 6, - 7, - 8, - 9, - 10, 99 ], - "title": "Reputation Score ID", + "title": "Service Start Type ID", "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" }, - "data": { - "title": "Data" + "service_type": { + "title": "Service Type", + "type": "string" }, - "flags": { + "service_type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Service Type ID", + "type": "integer" + }, + "tags": { "items": { - "type": "string" + "$ref": "#/$defs/key_value_object" }, - "title": "Flags", + "title": "Tags", "type": "array" }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, "required": [ - "uid" + "name" ], - "title": "Request Elements", + "title": "Windows Service", "type": "object" }, - "response": { + "group": { "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" + "anyOf": [ + { + "required": [ + "name" + ] }, - "data": { - "title": "Data" + { + "required": [ + "uid" + ] + } + ], + "properties": { + "desc": { + "title": "Description", + "type": "string" }, - "error": { - "title": "Error Code", + "domain": { + "title": "Domain", "type": "string" }, - "error_message": { - "title": "Error Message", + "name": { + "title": "Name", "type": "string" }, - "flags": { + "privileges": { "items": { "type": "string" }, - "title": "Flags", + "title": "Privileges", "type": "array" }, - "message": { - "title": "Message", + "type": { + "title": "Group Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate ID", "type": "string" } }, - "title": "Response Elements", + "title": "Group", "type": "object" }, - "rule": { + "device": { "additionalProperties": false, "anyOf": [ + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" + ] + }, { "required": [ "name" @@ -6188,61 +5908,157 @@ } ], "properties": { - "category": { - "title": "Category", + "region": { + "title": "Region", + "type": "string" + }, + "interface_name": { + "title": "Network Interface Name", "type": "string" }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "interface_uid": { + "title": "Network Interface ID", + "type": "string" + }, + "modified_time": { + "title": "Modified Time", + "type": "integer" + }, + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, "desc": { "title": "Description", "type": "string" }, - "name": { - "title": "Name", + "os_machine_uuid": { + "title": "OS Machine UUID", + "type": "string" + }, + "hypervisor": { + "title": "Hypervisor", "type": "string" }, "type": { "title": "Type", "type": "string" }, - "uid": { - "title": "Unique ID", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "is_backed_up": { + "title": "Back Ups Configured", + "type": "boolean" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "version": { - "title": "Version", + "first_seen_time": { + "title": "First Seen", + "type": "integer" + }, + "mac": { + "title": "MAC Address", "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { + }, + "imei_list": { + "items": { + "type": "string" + }, + "title": "IMEI List", + "type": "array" + }, + "org": { + "$ref": "#/$defs/organization", + "title": "Organization" + }, + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" + }, + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "image": { + "$ref": "#/$defs/image", + "title": "Image" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "is_shared": { + "title": "Shared Device", + "type": "boolean" + }, + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "meid": { + "title": "MEID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" + }, + "groups": { + "items": { + "$ref": "#/$defs/group" + }, + "title": "Groups", + "type": "array" + }, + "risk_score": { + "title": "Risk Score", + "type": "integer" + }, + "is_personal": { + "title": "Personal Device", + "type": "boolean" + }, "name": { "title": "Name", "type": "string" }, - "type": { - "title": "Type", + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" + }, + "iccid": { + "title": "ICCID", "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", + }, + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" + }, + "uid_alt": { + "title": "Alternate ID", "type": "string" }, - "auth_protocol_id": { + "udid": { + "title": "Unique Device Identifier", + "type": "string" + }, + "model": { + "title": "Model", + "type": "string" + }, + "type_id": { "enum": [ 0, 1, @@ -6257,58 +6073,39 @@ 10, 11, 12, + 13, + 14, + 15, 99 ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", + "title": "Type ID", "type": "integer" }, - "modified_time": { - "title": "Modified Time", + "last_seen_time": { + "title": "Last Seen", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" }, - "rate_limit": { - "title": "Rate Limit", + "boot_time": { + "title": "Boot Time", "type": "integer" }, - "scim_group_schema": { - "title": "SCIM Group Schema" + "is_supervised": { + "title": "Supervised Device", + "type": "boolean" }, - "scim_user_schema": { - "title": "SCIM User Schema" + "is_managed": { + "title": "Managed Device", + "type": "boolean" }, - "state": { - "title": "State", - "type": "string" + "container": { + "$ref": "#/$defs/container", + "title": "Container" }, - "state_id": { + "risk_level_id": { "enum": [ 0, 1, @@ -6317,250 +6114,271 @@ 4, 99 ], - "title": "State ID", + "title": "Risk Level ID", "type": "integer" }, - "uid": { - "title": "Unique ID", + "is_trusted": { + "title": "Trusted Device", + "type": "boolean" + }, + "boot_uid": { + "title": "Boot UID", "type": "string" }, - "uid_alt": { - "title": "External ID", + "network_interfaces": { + "items": { + "$ref": "#/$defs/network_interface" + }, + "title": "Network Interfaces", + "type": "array" + }, + "autoscale_uid": { + "title": "Autoscale UID", "type": "string" }, - "url_string": { - "title": "SCIM Endpoint URL", + "vpc_uid": { + "title": "VPC UID", "type": "string" }, - "vendor_name": { - "title": "Service Provider", + "subnet": { + "title": "Subnet", "type": "string" }, - "version": { - "title": "SCIM Version", + "eid": { + "title": "EID", "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" }, - "hashes": { + "domain": { + "title": "Domain", + "type": "string" + }, + "imei": { + "title": "IMEI", + "type": "string" + }, + "agent_list": { "items": { - "$ref": "#/$defs/fingerprint" + "$ref": "#/$defs/agent" }, - "title": "Hashes", + "title": "Agent List", "type": "array" }, - "name": { - "title": "Name", + "ip": { + "title": "IP Address", "type": "string" }, - "parent_uid": { - "title": "Parent Unique ID", + "hostname": { + "title": "Hostname", "type": "string" }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" + "is_mobile_account_active": { + "title": "Mobile Account Active", + "type": "boolean" }, - "uid": { - "title": "Unique ID", + "is_compliant": { + "title": "Compliant Device", + "type": "boolean" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, "required": [ - "script_content", "type_id" ], - "title": "Script", + "title": "Device", "type": "object" }, - "service": { + "campaign": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, "name": { "title": "Name", "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Campaign", + "type": "object" + }, + "cwe": { + "additionalProperties": false, + "properties": { + "caption": { + "title": "Caption", + "type": "string" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", + "src_url": { + "title": "Source URL", "type": "string" }, - "version": { - "title": "Version", + "uid": { + "title": "CWE ID", "type": "string" } }, - "title": "Service", + "required": [ + "uid" + ], + "title": "CWE", "type": "object" }, - "session": { + "digital_signature": { "additionalProperties": false, "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", + "algorithm": { + "title": "Algorithm", "type": "string" }, - "expiration_time": { - "title": "Expiration Time", + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Algorithm ID", "type": "integer" }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" + "certificate": { + "$ref": "#/$defs/certificate", + "title": "Certificate" }, - "issuer": { - "title": "Issuer Details", - "type": "string" + "created_time": { + "title": "Created Time", + "type": "integer" }, - "terminal": { - "title": "Terminal", + "developer_uid": { + "title": "Developer UID", "type": "string" }, - "uid": { - "title": "Unique ID", - "type": "string" + "digest": { + "$ref": "#/$defs/fingerprint", + "title": "Message Digest" }, - "uid_alt": { - "title": "Alternate ID", + "state": { + "title": "State", "type": "string" }, - "uuid": { - "title": "UUID", - "type": "string" + "state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + 99 + ], + "title": "State ID", + "type": "integer" } }, - "title": "Session", + "required": [ + "algorithm_id" + ], + "title": "Digital Signature", "type": "object" }, - "span": { + "malware_scan_info": { "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" + "anyOf": [ + { + "required": [ + "name" + ] }, + { + "required": [ + "uid" + ] + } + ], + "properties": { "end_time": { "title": "End Time", "type": "integer" }, - "message": { - "title": "Message", + "name": { + "title": "Name", "type": "string" }, - "operation": { - "title": "Operation", - "type": "string" + "num_files": { + "title": "Scanned Files", + "type": "integer" }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" + "num_infected": { + "title": "Number of Infected Entities", + "type": "integer" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" + "num_volumes": { + "title": "Number of Volumes", + "type": "integer" + }, + "size": { + "title": "Size", + "type": "integer" }, "start_time": { "title": "Start Time", "type": "integer" }, - "status_code": { - "title": "Status Code", + "type": { + "title": "Type", "type": "string" }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 99 + ], + "title": "Type ID", + "type": "integer" + }, "uid": { - "title": "Unique ID", + "title": "Scan UID", "type": "string" + }, + "unique_malware_count": { + "title": "Unique Malware Count", + "type": "integer" } }, "required": [ - "end_time", - "start_time", - "uid" + "type_id" ], - "title": "Span", + "title": "Malware Scan Info", "type": "object" }, - "sso": { + "kill_chain_phase": { "additionalProperties": false, "properties": { - "auth_protocol": { - "title": "Auth Protocol", + "phase": { + "title": "Kill Chain Phase", "type": "string" }, - "auth_protocol_id": { + "phase_id": { "enum": [ 0, 1, @@ -6570,76 +6388,19 @@ 5, 6, 7, - 8, - 9, - 10, - 11, - 12, 99 ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", + "title": "Kill Chain Phase ID", "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" } }, - "title": "SSO", + "required": [ + "phase_id" + ], + "title": "Kill Chain Phase", "type": "object" }, - "sub_technique": { + "organization": { "additionalProperties": false, "anyOf": [ { @@ -6658,8 +6419,12 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", + "ou_name": { + "title": "Org Unit Name", + "type": "string" + }, + "ou_uid": { + "title": "Org Unit ID", "type": "string" }, "uid": { @@ -6667,10 +6432,47 @@ "type": "string" } }, - "title": "MITRE Sub-technique", + "title": "Organization", "type": "object" }, - "tactic": { + "encryption_details": { + "additionalProperties": false, + "properties": { + "algorithm": { + "title": "Encryption Algorithm", + "type": "string" + }, + "algorithm_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 99 + ], + "title": "Encryption Algorithm ID", + "type": "integer" + }, + "key_length": { + "title": "Encryption Key Length", + "type": "integer" + }, + "key_uid": { + "title": "Key UID", + "type": "string" + }, + "type": { + "title": "Encryption Type", + "type": "string" + } + }, + "title": "Encryption Details", + "type": "object" + }, + "logger": { "additionalProperties": false, "anyOf": [ { @@ -6678,30 +6480,78 @@ "name" ] }, - { - "required": [ - "uid" - ] - } - ], - "properties": { + { + "required": [ + "uid" + ] + } + ], + "properties": { + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, + "event_uid": { + "title": "Event UID", + "type": "string" + }, + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "log_format": { + "title": "Log Format", + "type": "string" + }, + "log_level": { + "title": "Log Level", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "log_version": { + "title": "Log Version", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, "name": { "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "transmit_time": { + "title": "Transmission Time", + "type": "integer" }, "uid": { "title": "Unique ID", "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "MITRE Tactic", + "title": "Logger", "type": "object" }, - "technique": { + "feature": { "additionalProperties": false, "anyOf": [ { @@ -6720,27 +6570,39 @@ "title": "Name", "type": "string" }, - "src_url": { - "title": "Source URL", - "type": "string" - }, "uid": { "title": "Unique ID", "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "MITRE Technique", + "title": "Feature", "type": "object" }, - "threat_actor": { + "ja4_fingerprint": { "additionalProperties": false, "properties": { - "name": { - "title": "Name", + "section_a": { + "title": "JA4 Section A", + "type": "string" + }, + "section_b": { + "title": "JA4 Section B", + "type": "string" + }, + "section_c": { + "title": "JA4 Section C", + "type": "string" + }, + "section_d": { + "title": "JA4 Section D", "type": "string" }, "type": { - "title": "Threat Actor Type", + "title": "Type", "type": "string" }, "type_id": { @@ -6750,16 +6612,26 @@ 2, 3, 4, + 5, + 6, + 7, + 8, + 9, 99 ], - "title": "Threat Actor Type ID", + "title": "Type ID", "type": "integer" + }, + "value": { + "title": "Value", + "type": "string" } }, "required": [ - "name" + "type_id", + "value" ], - "title": "Threat Actor", + "title": "JA4+ Fingerprint", "type": "object" }, "timespan": { @@ -6882,240 +6754,455 @@ "title": "Time Span", "type": "object" }, - "tls": { + "rule": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], "properties": { - "alert": { - "title": "Client TLS Alert", + "category": { + "title": "Category", + "type": "string" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "name": { + "title": "Name", + "type": "string" + }, + "type": { + "title": "Type", + "type": "string" + }, + "uid": { + "title": "Unique ID", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Rule", + "type": "object" + }, + "http_cookie": { + "additionalProperties": false, + "properties": { + "domain": { + "title": "Domain", + "type": "string" + }, + "expiration_time": { + "title": "Expiration Time", "type": "integer" }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" + "http_only": { + "title": "HTTP Only", + "type": "boolean" }, - "certificate_chain": { + "is_http_only": { + "title": "HTTP Only", + "type": "boolean" + }, + "is_secure": { + "title": "Secure", + "type": "boolean" + }, + "name": { + "title": "Name", + "type": "string" + }, + "path": { + "title": "Path", + "type": "string" + }, + "samesite": { + "title": "SameSite", + "type": "string" + }, + "secure": { + "title": "Secure", + "type": "boolean" + }, + "value": { + "title": "Value", + "type": "string" + } + }, + "required": [ + "name", + "value" + ], + "title": "HTTP Cookie", + "type": "object" + }, + "agent": { + "additionalProperties": false, + "anyOf": [ + { + "required": [ + "name" + ] + }, + { + "required": [ + "uid" + ] + } + ], + "properties": { + "name": { + "title": "Agent Name", + "type": "string" + }, + "policies": { "items": { - "type": "string" + "$ref": "#/$defs/policy" }, - "title": "Certificate Chain", + "title": "Agent Policies", "type": "array" }, - "cipher": { - "title": "Cipher Suite", + "type": { + "title": "Agent Type", + "type": "string" + }, + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Type ID", + "type": "integer" + }, + "uid": { + "title": "Agent ID", + "type": "string" + }, + "uid_alt": { + "title": "Alternate Agent ID", + "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Agent Version", + "type": "string" + } + }, + "title": "Agent", + "type": "object" + }, + "whois": { + "additionalProperties": false, + "properties": { + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" + }, + "created_time": { + "title": "Registered At", + "type": "integer" + }, + "dnssec_status": { + "title": "DNSSEC Status", + "type": "string" + }, + "dnssec_status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "DNSSEC Status ID", + "type": "integer" + }, + "domain": { + "title": "Domain", "type": "string" }, - "client_ciphers": { - "items": { - "type": "string" - }, - "title": "Client Cipher Suites", - "type": "array" - }, - "extension_list": { + "domain_contacts": { "items": { - "$ref": "#/$defs/tls_extension" + "$ref": "#/$defs/domain_contact" }, - "title": "Extension List", + "title": "Domain Contacts", "type": "array" }, - "handshake_dur": { - "title": "Handshake Duration", - "type": "integer" + "email_addr": { + "title": "Registrar Abuse Email Address", + "type": "string" }, - "ja3_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3 Hash" + "isp": { + "title": "ISP Name", + "type": "string" }, - "ja3s_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3S Hash" + "isp_org": { + "title": "ISP Org", + "type": "string" }, - "key_length": { - "title": "Key Length", + "last_seen_time": { + "title": "Last Updated At", "type": "integer" }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "server_ciphers": { + "name_servers": { "items": { "type": "string" }, - "title": "Server Cipher Suites", + "title": "Name Servers", "type": "array" }, - "sni": { - "title": "Server Name Indication", + "phone_number": { + "title": "Registrar Abuse Phone Number", "type": "string" }, - "tls_extension_list": { + "registrar": { + "title": "Domain Registrar", + "type": "string" + }, + "status": { + "title": "Domain Status", + "type": "string" + }, + "subdomains": { "items": { - "$ref": "#/$defs/tls_extension" + "type": "string" }, - "title": "TLS Extension List", + "title": "Subdomains", "type": "array" }, - "version": { - "title": "Version", + "subnet": { + "title": "Subnet Block", "type": "string" } }, - "required": [ - "version" - ], - "title": "Transport Layer Security (TLS)", + "title": "WHOIS", "type": "object" }, - "tls_extension": { + "key_value_object": { "additionalProperties": false, + "anyOf": [ + { + "required": [ + "value" + ] + }, + { + "required": [ + "values" + ] + } + ], "properties": { - "data": { - "title": "Data" + "name": { + "title": "Name", + "type": "string" }, - "type": { - "title": "Type", + "value": { + "title": "Value", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 5, - 10, - 13, - 14, - 15, - 16, - 18, - 19, - 20, - 21, - 41, - 42, - 43, - 44, - 45, - 47, - 48, - 49, - 50, - 51, - 99 - ], - "title": "Type ID", - "type": "integer" + "values": { + "items": { + "type": "string" + }, + "title": "Values", + "type": "array" } }, "required": [ - "type_id" + "name" ], - "title": "TLS Extension", + "title": "Key:Value object", "type": "object" }, - "token": { + "metadata": { "additionalProperties": false, "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" + "log_format": { + "title": "Log Source Format", + "type": "string" }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" + "transformation_info_list": { + "items": { + "$ref": "#/$defs/transformation_info" + }, + "title": "Transformation Info", + "type": "array" }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" + "uid": { + "title": "Event UID", + "type": "string" + }, + "original_event_uid": { + "title": "Original Event ID", + "type": "string" + }, + "log_name": { + "title": "Log Name", + "type": "string" }, "modified_time": { "title": "Modified Time", "type": "integer" }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", + "log_level": { + "title": "Log Level", "type": "string" }, "type": { "title": "Type", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", + "log_version": { + "title": "Log Version", + "type": "string" + }, + "extensions": { + "items": { + "$ref": "#/$defs/extension" + }, + "title": "Schema Extensions", + "type": "array" + }, + "source": { + "title": "Source", + "type": "string" + }, + "untruncated_size": { + "title": "Untruncated Size", + "type": "integer" + }, + "loggers": { + "items": { + "$ref": "#/$defs/logger" + }, + "title": "Loggers", + "type": "array" + }, + "processed_time": { + "title": "Processed Time", "type": "integer" }, - "uid": { - "title": "Unique ID", + "log_source": { + "title": "Log Source", + "type": "string" + }, + "logged_time": { + "title": "Logged Time", + "type": "integer" + }, + "debug": { + "items": { + "type": "string" + }, + "title": "Debug Information", + "type": "array" + }, + "profiles": { + "items": { + "type": "string" + }, + "title": "Profiles", + "type": "array" + }, + "log_provider": { + "title": "Log Provider", + "type": "string" + }, + "event_code": { + "title": "Event Code", + "type": "string" + }, + "tags": { + "items": { + "$ref": "#/$defs/key_value_object" + }, + "title": "Tags", + "type": "array" + }, + "tenant_uid": { + "title": "Tenant UID", "type": "string" }, - "zone": { - "title": "Network Zone", + "reporter": { + "$ref": "#/$defs/reporter", + "title": "Reporter" + }, + "correlation_uid": { + "title": "Correlation UID", "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" }, - "end_time": { - "title": "End Time", - "type": "integer" + "extension": { + "$ref": "#/$defs/extension", + "title": "Schema Extension" }, - "flags": { + "labels": { "items": { "type": "string" }, - "title": "Flags", + "title": "Labels", "type": "array" }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" + "sequence": { + "title": "Sequence Number", + "type": "integer" }, - "start_time": { - "title": "Start Time", + "transmit_time": { + "title": "Transmission Time", "type": "integer" }, - "uid": { - "title": "Unique ID", + "is_truncated": { + "title": "Is Truncated", + "type": "boolean" + }, + "original_time": { + "title": "Original Time", + "type": "string" + }, + "total_queued_duration": { + "$ref": "#/$defs/timespan", + "title": "Total Queued Duration" + }, + "product": { + "$ref": "#/$defs/product", + "title": "Product" + }, + "version": { + "title": "Version", "type": "string" } }, "required": [ - "uid" + "product", + "version" ], - "title": "Trace", + "title": "Metadata", "type": "object" }, - "transformation_info": { + "product": { "additionalProperties": false, "anyOf": [ { @@ -7130,6 +7217,14 @@ } ], "properties": { + "cpe_name": { + "title": "The product CPE identifier", + "type": "string" + }, + "feature": { + "$ref": "#/$defs/feature", + "title": "Feature" + }, "lang": { "title": "Language", "type": "string" @@ -7138,13 +7233,9 @@ "title": "Name", "type": "string" }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" + "path": { + "title": "Path", + "type": "string" }, "uid": { "title": "Unique ID", @@ -7153,175 +7244,148 @@ "url_string": { "title": "URL String", "type": "string" + }, + "vendor_name": { + "title": "Vendor Name", + "type": "string" + }, + "version": { + "title": "Version", + "type": "string" } }, - "title": "Transformation Info", + "title": "Product", "type": "object" }, - "url": { + "advisory": { "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" + "avg_timespan": { + "$ref": "#/$defs/timespan", + "title": "Average Timespan" }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" + "bulletin": { + "title": "Patch Bulletin", + "type": "string" + }, + "classification": { + "title": "Classification", + "type": "string" + }, + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "desc": { + "title": "Description", + "type": "string" + }, + "install_state": { + "title": "Install State", + "type": "string" + }, + "install_state_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Install State ID", + "type": "integer" + }, + "is_superseded": { + "title": "The patch is superseded.", + "type": "boolean" }, - "domain": { - "title": "Domain", - "type": "string" + "modified_time": { + "title": "Modified Time", + "type": "integer" }, - "hostname": { - "title": "Hostname", - "type": "string" + "os": { + "$ref": "#/$defs/os", + "title": "OS" }, - "path": { - "title": "Path", - "type": "string" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "port": { - "title": "Port", - "type": "integer" + "references": { + "items": { + "type": "string" + }, + "title": "References", + "type": "array" }, - "query_string": { - "title": "HTTP Query String", - "type": "string" + "related_cves": { + "items": { + "$ref": "#/$defs/cve" + }, + "title": "Related CVEs", + "type": "array" }, - "resource_type": { - "title": "Resource Type", - "type": "string" + "related_cwes": { + "items": { + "$ref": "#/$defs/cwe" + }, + "title": "Related CWEs", + "type": "array" }, - "scheme": { - "title": "Scheme", + "size": { + "title": "Size", + "type": "integer" + }, + "src_url": { + "title": "Source URL", "type": "string" }, - "subdomain": { - "title": "Subdomain", + "title": { + "title": "Title", "type": "string" }, - "url_string": { - "title": "URL String", + "uid": { + "title": "Advisory ID", "type": "string" } }, - "title": "Uniform Resource Locator", + "required": [ + "uid" + ], + "title": "Advisory", "type": "object" }, - "user": { + "network_endpoint": { "additionalProperties": false, "anyOf": [ { "required": [ - "account" + "domain" + ] + }, + { + "required": [ + "hostname" + ] + }, + { + "required": [ + "instance_uid" + ] + }, + { + "required": [ + "interface_name" + ] + }, + { + "required": [ + "interface_uid" + ] + }, + { + "required": [ + "ip" ] }, { @@ -7329,6 +7393,11 @@ "name" ] }, + { + "required": [ + "svc_name" + ] + }, { "required": [ "uid" @@ -7336,549 +7405,480 @@ } ], "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", + "interface_name": { + "title": "Network Interface Name", "type": "string" }, - "display_name": { - "title": "Display Name", + "uid": { + "title": "Unique ID", "type": "string" }, - "domain": { - "title": "Domain", + "interface_uid": { + "title": "Network Interface ID", "type": "string" }, - "email_addr": { - "title": "Email Address", + "os": { + "$ref": "#/$defs/os", + "title": "OS" + }, + "port": { + "title": "Port", + "type": "integer" + }, + "type": { + "title": "Type", "type": "string" }, - "forward_addr": { - "title": "Forwarding Address", + "location": { + "$ref": "#/$defs/location", + "title": "Geo Location" + }, + "instance_uid": { + "title": "Instance ID", "type": "string" }, - "full_name": { - "title": "Full Name", + "mac": { + "title": "MAC Address", "type": "string" }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" + "autonomous_system": { + "$ref": "#/$defs/autonomous_system", + "title": "Autonomous System" }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" + "pool": { + "$ref": "#/$defs/group", + "title": "Pool" }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" + "subnet_uid": { + "title": "Subnet UID", + "type": "string" + }, + "isp": { + "title": "ISP Name", + "type": "string" + }, + "zone": { + "title": "Network Zone", + "type": "string" }, "name": { "title": "Name", "type": "string" }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" + "hw_info": { + "$ref": "#/$defs/device_hw_info", + "title": "Hardware Info" }, - "phone_number": { - "title": "Telephone Number", - "type": "string" + "namespace_pid": { + "title": "Namespace PID", + "type": "integer" }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" + "network_scope_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Network Scope ID", + "type": "integer" }, - "risk_level": { - "title": "Risk Level", + "svc_name": { + "title": "Service Name", "type": "string" }, - "risk_level_id": { + "type_id": { "enum": [ 0, 1, 2, 3, 4, + 5, + 6, + 7, + 8, + 9, + 10, + 11, + 12, + 13, + 14, + 15, 99 ], - "title": "Risk Level ID", + "title": "Type ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", - "type": "integer" + "network_scope": { + "title": "Network Scope", + "type": "string" + }, + "owner": { + "$ref": "#/$defs/user", + "title": "Owner" + }, + "container": { + "$ref": "#/$defs/container", + "title": "Container" + }, + "intermediate_ips": { + "items": { + "type": "string" + }, + "title": "Intermediate IP Addresses", + "type": "array" + }, + "isp_org": { + "title": "ISP Org", + "type": "string" + }, + "fingerprints": { + "items": { + "$ref": "#/$defs/fingerprint" + }, + "title": "Fingerprints", + "type": "array" + }, + "vpc_uid": { + "title": "VPC UID", + "type": "string" + }, + "domain": { + "title": "Domain", + "type": "string" + }, + "agent_list": { + "items": { + "$ref": "#/$defs/agent" + }, + "title": "Agent List", + "type": "array" }, - "type": { - "title": "Type", + "ip": { + "title": "IP Address", "type": "string" }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" + "hostname": { + "title": "Hostname", + "type": "string" }, - "uid": { - "title": "Unique ID", + "vlan_uid": { + "title": "VLAN", "type": "string" }, - "uid_alt": { - "title": "Alternate ID", + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" + }, + "mac_vendor": { + "title": "MAC Vendor", "type": "string" } }, - "title": "User", + "title": "Network Endpoint", "type": "object" }, - "vulnerability": { + "d3f_tactic": { "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, + "anyOf": [ { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, "required": [ - "cve" + "name" ] }, { - "not": { - "required": [ - "advisory", - "cve" - ] - }, "required": [ - "cwe" + "uid" ] } ], "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" + "name": { + "title": "Name", + "type": "string" }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" + "src_url": { + "title": "Source URL", + "type": "string" }, - "affected_packages": { + "uid": { + "title": "Unique ID", + "type": "string" + } + }, + "title": "MITRE D3FEND\u2122 Tactic", + "type": "object" + }, + "cve": { + "additionalProperties": false, + "properties": { + "created_time": { + "title": "Created Time", + "type": "integer" + }, + "cvss": { "items": { - "$ref": "#/$defs/affected_package" + "$ref": "#/$defs/cvss" }, - "title": "Affected Software Packages", + "title": "CVSS Score", "type": "array" }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, "cwe": { "$ref": "#/$defs/cwe", "title": "CWE" }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", + "cwe_uid": { + "title": "CWE UID", "type": "string" }, - "exploit_requirement": { - "title": "Exploit Requirement", + "cwe_url": { + "title": "CWE URL", "type": "string" }, - "exploit_type": { - "title": "Exploit Type", + "desc": { + "title": "Description", "type": "string" }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" + "epss": { + "$ref": "#/$defs/epss", + "title": "EPSS" }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", + "modified_time": { + "title": "Modified Time", "type": "integer" }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" + "product": { + "$ref": "#/$defs/product", + "title": "Product" }, - "kb_article_list": { + "references": { "items": { - "$ref": "#/$defs/kb_article" + "type": "string" }, - "title": "Knowledgebase Articles", + "title": "References", "type": "array" }, - "kb_articles": { + "related_cwes": { "items": { - "type": "string" + "$ref": "#/$defs/cwe" }, - "title": "Knowledgebase Articles", + "title": "Related CWEs", "type": "array" }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" + "title": { + "title": "Title", + "type": "string" }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" + "type": { + "title": "Vulnerability Type", + "type": "string" }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" + "uid": { + "title": "CVE ID", + "type": "string" + } + }, + "required": [ + "uid" + ], + "title": "CVE", + "type": "object" + }, + "domain_contact": { + "additionalProperties": false, + "properties": { + "email_addr": { + "title": "Contact Email", + "type": "string" }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" + "location": { + "$ref": "#/$defs/location", + "title": "Contact Location Information" }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" + "name": { + "title": "Name", + "type": "string" }, - "severity": { - "title": "Severity", + "phone_number": { + "title": "Phone Number", "type": "string" }, - "title": { - "title": "Title", + "type": { + "title": "Domain Contact Type", "type": "string" }, - "vendor_name": { - "title": "Vendor Name", + "type_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 99 + ], + "title": "Domain Contact Type ID", + "type": "integer" + }, + "uid": { + "title": "Unique ID", "type": "string" } }, - "title": "Vulnerability Details", + "required": [ + "type_id" + ], + "title": "Domain Contact", "type": "object" }, - "whois": { + "tls_extension": { "additionalProperties": false, "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" + "data": { + "title": "Data" }, - "dnssec_status": { - "title": "DNSSEC Status", + "type": { + "title": "Type", "type": "string" }, - "dnssec_status_id": { + "type_id": { "enum": [ 0, 1, - 2, + 5, + 10, + 13, + 14, + 15, + 16, + 18, + 19, + 20, + 21, + 41, + 42, + 43, + 44, + 45, + 47, + 48, + 49, + 50, + 51, 99 ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", + "title": "Type ID", "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" } }, - "title": "WHOIS", + "required": [ + "type_id" + ], + "title": "TLS Extension", "type": "object" }, - "win_win_service": { + "policy": { "additionalProperties": false, "anyOf": [ { "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" + "name" ] }, { "required": [ - "service_start_type_id" + "type" ] }, { "required": [ - "service_type_id" + "uid" ] } ], "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" + "data": { + "title": "Data" }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" + "desc": { + "title": "Description", + "type": "string" }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" + "group": { + "$ref": "#/$defs/group", + "title": "Group" }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" + "is_applied": { + "title": "Applied", + "type": "boolean" }, "name": { "title": "Name", "type": "string" }, - "service_category": { - "title": "Service Category", + "type": { + "title": "Type", "type": "string" }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", + "uid": { + "title": "Unique ID", "type": "string" }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", + "version": { + "title": "Version", + "type": "string" + } + }, + "title": "Policy", + "type": "object" + }, + "span": { + "additionalProperties": false, + "properties": { + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" + "end_time": { + "title": "End Time", + "type": "integer" }, - "service_start_name": { - "title": "Service Start Name", + "message": { + "title": "Message", "type": "string" }, - "service_start_type": { - "title": "Service Start Type", + "operation": { + "title": "Operation", "type": "string" }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", + "parent_uid": { + "title": "Parent Unique ID", "type": "string" }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", + "service": { + "$ref": "#/$defs/service", + "title": "Service" + }, + "start_time": { + "title": "Start Time", "type": "integer" }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" + "status_code": { + "title": "Status Code", + "type": "string" }, "uid": { "title": "Unique ID", "type": "string" - }, - "version": { - "title": "Version", - "type": "string" } }, "required": [ - "name" + "end_time", + "start_time", + "uid" ], - "title": "Windows Service", + "title": "Span", "type": "object" } }, @@ -7898,124 +7898,88 @@ } ], "properties": { - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" + "traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Traffic" }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Activity ID", - "type": "integer" + "unmapped": { + "$ref": "#/$defs/object", + "title": "Unmapped Data" }, - "activity_name": { - "title": "Activity", + "message": { + "title": "Message", "type": "string" }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" + "http_response": { + "$ref": "#/$defs/http_response", + "title": "HTTP Response" }, "app_name": { "title": "Application Name", "type": "string" }, - "app_protocol_name": { - "title": "Application Protocol Name", + "disposition": { + "title": "Disposition", "type": "string" }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" + "proxy_http_request": { + "$ref": "#/$defs/http_request", + "title": "Proxy HTTP Request" }, - "category_name": { - "title": "Category", + "app_protocol_name": { + "title": "Application Protocol Name", "type": "string" }, + "proxy_connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Proxy Connection Info" + }, "category_uid": { "const": 4, "title": "Category ID", "type": "integer" }, - "class_name": { - "title": "Class", + "action": { + "title": "Action", "type": "string" }, - "class_uid": { - "const": 4002, - "title": "Class ID", - "type": "integer" - }, "confidence": { "title": "Confidence", "type": "string" }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" + "ja4_fingerprint_list": { + "items": { + "$ref": "#/$defs/ja4_fingerprint" + }, + "title": "JA4+ Fingerprints", + "type": "array" }, - "confidence_score": { - "title": "Confidence Score", - "type": "integer" + "cumulative_traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Cumulative Traffic" }, - "connection_info": { - "$ref": "#/$defs/network_connection_info", - "title": "Connection Info" + "risk_details": { + "title": "Risk Details", + "type": "string" }, - "count": { - "title": "Count", + "duration": { + "title": "Duration Milliseconds", "type": "integer" }, - "cumulative_traffic": { - "$ref": "#/$defs/network_traffic", - "title": "Cumulative Traffic" + "status_detail": { + "title": "Status Detail", + "type": "string" }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" + "confidence_score": { + "title": "Confidence Score", + "type": "integer" }, - "disposition": { - "title": "Disposition", + "proxy_tls": { + "$ref": "#/$defs/tls", + "title": "Proxy TLS" + }, + "status_code": { + "title": "Status Code", "type": "string" }, "disposition_id": { @@ -8053,96 +8017,146 @@ "title": "Disposition ID", "type": "integer" }, - "dst_endpoint": { + "type_name": { + "title": "Type Name", + "type": "string" + }, + "network_observation_point": { "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" + "title": "Network Observation Point" }, - "duration": { - "title": "Duration Milliseconds", + "risk_level": { + "title": "Risk Level", + "type": "string" + }, + "raw_data": { + "title": "Raw Data", + "type": "string" + }, + "time": { + "title": "Event Time", "type": "integer" }, - "end_time": { - "title": "End Time", + "status_id": { + "enum": [ + 0, + 1, + 2, + 99 + ], + "title": "Status ID", "type": "integer" }, - "enrichments": { + "actor": { + "$ref": "#/$defs/actor", + "title": "Actor" + }, + "proxy_http_response": { + "$ref": "#/$defs/http_response", + "title": "Proxy HTTP Response" + }, + "trace": { + "$ref": "#/$defs/trace", + "title": "Trace" + }, + "attacks": { "items": { - "$ref": "#/$defs/enrichment" + "$ref": "#/$defs/attack" }, - "title": "Enrichments", + "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", "type": "array" }, + "status": { + "title": "Status", + "type": "string" + }, + "activity_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 99 + ], + "title": "Activity ID", + "type": "integer" + }, "file": { "$ref": "#/$defs/file", "title": "File" }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "http_cookies": { + "packet_list": { "items": { - "$ref": "#/$defs/http_cookie" - }, - "title": "HTTP Cookies", - "type": "array" - }, - "http_request": { - "$ref": "#/$defs/http_request", - "title": "HTTP Request" - }, - "http_response": { - "$ref": "#/$defs/http_response", - "title": "HTTP Response" + "$ref": "#/$defs/packet" + }, + "title": "Packets", + "type": "array" }, - "http_status": { - "title": "HTTP Status", + "risk_score": { + "title": "Risk Score", "type": "integer" }, - "is_alert": { - "title": "Alert", - "type": "boolean" + "proxy_traffic": { + "$ref": "#/$defs/network_traffic", + "title": "Proxy Traffic" }, - "ja4_fingerprint_list": { + "observables": { "items": { - "$ref": "#/$defs/ja4_fingerprint" + "$ref": "#/$defs/observable" }, - "title": "JA4+ Fingerprints", + "title": "Observables", "type": "array" }, - "malware": { + "enrichments": { "items": { - "$ref": "#/$defs/malware" + "$ref": "#/$defs/enrichment" }, - "title": "Malware", + "title": "Enrichments", "type": "array" }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "network_observation_point": { - "$ref": "#/$defs/network_endpoint", - "title": "Network Observation Point" + "http_request": { + "$ref": "#/$defs/http_request", + "title": "HTTP Request" }, - "observables": { + "authorizations": { "items": { - "$ref": "#/$defs/observable" + "$ref": "#/$defs/authorization" }, - "title": "Observables", + "title": "Authorization Information", "type": "array" }, - "observation_point": { - "title": "Observation Point", - "type": "string" + "raw_data_hash": { + "$ref": "#/$defs/fingerprint", + "title": "Raw Data Hash" + }, + "action_id": { + "enum": [ + 0, + 1, + 2, + 3, + 4, + 99 + ], + "title": "Action ID", + "type": "integer" + }, + "confidence_id": { + "enum": [ + 0, + 1, + 2, + 3, + 99 + ], + "title": "Confidence ID", + "type": "integer" }, "observation_point_id": { "enum": [ @@ -8156,64 +8170,42 @@ "title": "Observation Point ID", "type": "integer" }, - "packet_list": { - "items": { - "$ref": "#/$defs/packet" - }, - "title": "Packets", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" + "firewall_rule": { + "$ref": "#/$defs/firewall_rule", + "title": "Firewall Rule" }, "proxy": { "$ref": "#/$defs/network_proxy", "title": "Proxy" }, - "proxy_connection_info": { - "$ref": "#/$defs/network_connection_info", - "title": "Proxy Connection Info" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "proxy_http_request": { - "$ref": "#/$defs/http_request", - "title": "Proxy HTTP Request" - }, - "proxy_http_response": { - "$ref": "#/$defs/http_response", - "title": "Proxy HTTP Response" - }, - "proxy_tls": { - "$ref": "#/$defs/tls", - "title": "Proxy TLS" + "class_uid": { + "const": 4002, + "title": "Class ID", + "type": "integer" }, - "proxy_traffic": { - "$ref": "#/$defs/network_traffic", - "title": "Proxy Traffic" + "http_status": { + "title": "HTTP Status", + "type": "integer" }, - "raw_data": { - "title": "Raw Data", + "activity_name": { + "title": "Activity", "type": "string" }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" + "tls": { + "$ref": "#/$defs/tls", + "title": "TLS" }, - "raw_data_size": { - "title": "Raw Data Size", + "start_time": { + "title": "Start Time", "type": "integer" }, - "risk_details": { - "title": "Risk Details", + "class_name": { + "title": "Class", "type": "string" }, - "risk_level": { - "title": "Risk Level", - "type": "string" + "timezone_offset": { + "title": "Timezone Offset", + "type": "integer" }, "risk_level_id": { "enum": [ @@ -8227,14 +8219,45 @@ "title": "Risk Level ID", "type": "integer" }, - "risk_score": { - "title": "Risk Score", + "raw_data_size": { + "title": "Raw Data Size", "type": "integer" }, + "malware": { + "items": { + "$ref": "#/$defs/malware" + }, + "title": "Malware", + "type": "array" + }, + "observation_point": { + "title": "Observation Point", + "type": "string" + }, + "dst_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Destination Endpoint" + }, + "is_alert": { + "title": "Alert", + "type": "boolean" + }, + "device": { + "$ref": "#/$defs/device", + "title": "Device" + }, "severity": { "title": "Severity", "type": "string" }, + "category_name": { + "title": "Category", + "type": "string" + }, + "malware_scan_info": { + "$ref": "#/$defs/malware_scan_info", + "title": "Malware Scan Info" + }, "severity_id": { "enum": [ 0, @@ -8249,67 +8272,44 @@ "title": "Severity ID", "type": "integer" }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "start_time": { - "title": "Start Time", + "count": { + "title": "Count", "type": "integer" }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" + "http_cookies": { + "items": { + "$ref": "#/$defs/http_cookie" + }, + "title": "HTTP Cookies", + "type": "array" }, - "time": { - "title": "Event Time", + "end_time": { + "title": "End Time", "type": "integer" }, - "timezone_offset": { - "title": "Timezone Offset", + "type_uid": { + "title": "Type ID", "type": "integer" }, - "tls": { - "$ref": "#/$defs/tls", - "title": "TLS" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" + "src_endpoint": { + "$ref": "#/$defs/network_endpoint", + "title": "Source Endpoint" }, - "traffic": { - "$ref": "#/$defs/network_traffic", - "title": "Traffic" + "metadata": { + "$ref": "#/$defs/metadata", + "title": "Metadata" }, - "type_name": { - "title": "Type Name", - "type": "string" + "proxy_endpoint": { + "$ref": "#/$defs/network_proxy", + "title": "Proxy Endpoint" }, - "type_uid": { - "title": "Type ID", - "type": "integer" + "connection_info": { + "$ref": "#/$defs/network_connection_info", + "title": "Connection Info" }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" + "policy": { + "$ref": "#/$defs/policy", + "title": "Policy" } }, "required": [ diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/network_activity@container+host+network_proxy+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/network_activity@container+host+network_proxy+security_control+trace.json deleted file mode 100644 index 5803868f12..0000000000 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/network_activity@container+host+network_proxy+security_control+trace.json +++ /dev/null @@ -1,8259 +0,0 @@ -{ - "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for network_activity. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", - "$defs": { - "account": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Advisory ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Advisory", - "type": "object" - }, - "affected_code": { - "additionalProperties": false, - "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" - }, - "start_column": { - "title": "Start Column", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "required": [ - "file" - ], - "title": "Affected Code", - "type": "object" - }, - "affected_package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "fixed_in_version": { - "title": "Fixed In Version", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", - "type": "object" - }, - "agent": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Agent Name", - "type": "string" - }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Agent ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate Agent ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Agent Version", - "type": "string" - } - }, - "title": "Agent", - "type": "object" - }, - "analytic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" - }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "operation" - ], - "title": "API", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" - }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "factor_type": { - "title": "Factor Type", - "type": "string" - }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" - }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" - }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - }, - "zone": { - "title": "Cloud Availability Zone", - "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Container", - "type": "object" - }, - "cve": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Vulnerability Type", - "type": "string" - }, - "uid": { - "title": "CVE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "vector_string": { - "title": "Vector String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "CWE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CWE", - "type": "object" - }, - "d3f_tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Technique", - "type": "object" - }, - "d3fend": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], - "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "category_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Category ID", - "type": "integer" - }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Data Classification", - "type": "object" - }, - "device": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "eid": { - "title": "EID", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", - "type": "string" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", - "type": "string" - }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "meid": { - "title": "MEID", - "type": "string" - }, - "model": { - "title": "Model", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "region": { - "title": "Region", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "subnet": { - "title": "Subnet", - "type": "string" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Device", - "type": "object" - }, - "device_hw_info": { - "additionalProperties": false, - "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" - }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", - "type": "string" - }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" - }, - "chassis": { - "title": "Chassis", - "type": "string" - }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" - }, - "cpu_architecture_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" - }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" - }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" - }, - "cpu_type": { - "title": "Processor Type", - "type": "string" - }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", - "type": "integer" - }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" - }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" - }, - "ram_size": { - "title": "RAM Size", - "type": "integer" - }, - "serial_number": { - "title": "Serial Number", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "developer_uid": { - "title": "Developer UID", - "type": "string" - }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" - }, - "type": { - "title": "Encryption Type", - "type": "string" - } - }, - "title": "Encryption Details", - "type": "object" - }, - "endpoint_connection": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "code" - ] - }, - { - "required": [ - "network_endpoint" - ] - } - ], - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "network_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Network Endpoint" - } - }, - "title": "Endpoint Connection", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "score" - ], - "title": "EPSS", - "type": "object" - }, - "extension": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "drive_type": { - "title": "Drive Type", - "type": "string" - }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, - "name": { - "title": "Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "File", - "type": "object" - }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "condition": { - "title": "Condition", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "match_details": { - "items": { - "type": "string" - }, - "title": "Match Details", - "type": "array" - }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", - "type": "integer" - }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", - "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" - } - }, - "title": "GPU Information", - "type": "object" - }, - "group": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" - }, - "type": { - "title": "Group Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "http_request": { - "additionalProperties": false, - "properties": { - "args": { - "title": "HTTP Arguments", - "type": "string" - }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", - "type": "string" - }, - "length": { - "title": "Request Length", - "type": "integer" - }, - "referrer": { - "title": "HTTP Referrer", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", - "type": "string" - }, - "version": { - "title": "HTTP Version", - "type": "string" - }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" - } - }, - "title": "HTTP Request", - "type": "object" - }, - "http_response": { - "additionalProperties": false, - "properties": { - "body_length": { - "title": "Response Body Length", - "type": "integer" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "content_type": { - "title": "HTTP Content Type", - "type": "string" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" - }, - "length": { - "title": "Response Length", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - } - }, - "required": [ - "code" - ], - "title": "HTTP Response", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "ja4_fingerprint": { - "additionalProperties": false, - "properties": { - "section_a": { - "title": "JA4 Section A", - "type": "string" - }, - "section_b": { - "title": "JA4 Section B", - "type": "string" - }, - "section_c": { - "title": "JA4 Section C", - "type": "string" - }, - "section_d": { - "title": "JA4 Section D", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "JA4+ Fingerprint", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "KB Article", - "type": "object" - }, - "key_value_object": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "required": [ - "name" - ], - "title": "Key:Value object", - "type": "object" - }, - "keyboard_info": { - "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "office_location": { - "title": "Office Location", - "type": "string" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "surname": { - "title": "Surname", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "load_balancer": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification": { - "title": "Classification", - "type": "string" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "endpoint_connections": { - "items": { - "$ref": "#/$defs/endpoint_connection" - }, - "title": "Endpoint Connections", - "type": "array" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Load Balancer", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" - }, - "city": { - "title": "City", - "type": "string" - }, - "continent": { - "title": "Continent", - "type": "string" - }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" - }, - "geohash": { - "title": "Geohash", - "type": "string" - }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" - }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" - }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", - "type": "object" - }, - "metadata": { - "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_source": { - "title": "Log Source", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", - "type": "string" - }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_connection_info": { - "additionalProperties": false, - "properties": { - "boundary": { - "title": "Boundary", - "type": "string" - }, - "boundary_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Boundary ID", - "type": "integer" - }, - "community_uid": { - "title": "Community ID", - "type": "string" - }, - "direction": { - "title": "Direction", - "type": "string" - }, - "direction_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Direction ID", - "type": "integer" - }, - "flag_history": { - "title": "Connection Flag History", - "type": "string" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - }, - "protocol_ver": { - "title": "IP Version", - "type": "string" - }, - "protocol_ver_id": { - "enum": [ - 0, - 4, - 6, - 99 - ], - "title": "IP Version ID", - "type": "integer" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "tcp_flags": { - "title": "TCP Flags", - "type": "integer" - }, - "uid": { - "title": "Connection UID", - "type": "string" - } - }, - "required": [ - "direction_id" - ], - "title": "Network Connection Information", - "type": "object" - }, - "network_endpoint": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" - }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "network_proxy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "network_traffic": { - "additionalProperties": false, - "properties": { - "bytes": { - "title": "Total Bytes", - "type": "integer" - }, - "bytes_in": { - "title": "Bytes In", - "type": "integer" - }, - "bytes_missed": { - "title": "Bytes Missed", - "type": "integer" - }, - "bytes_out": { - "title": "Bytes Out", - "type": "integer" - }, - "chunks": { - "title": "Chunks", - "type": "integer" - }, - "chunks_in": { - "title": "Chunks In", - "type": "integer" - }, - "chunks_out": { - "title": "Chunks Out", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "packets": { - "title": "Total Packets", - "type": "integer" - }, - "packets_in": { - "title": "Packets In", - "type": "integer" - }, - "packets_out": { - "title": "Packets Out", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "timespan": { - "$ref": "#/$defs/timespan", - "title": "Time Span" - } - }, - "title": "Network Traffic", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", - "type": "object" - }, - "observable": { - "additionalProperties": false, - "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", - "type": "string" - }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "title": "Occurrence Details", - "type": "object" - }, - "organization": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Package", - "type": "object" - }, - "packet": { - "additionalProperties": false, - "properties": { - "encoding": { - "title": "Encoding", - "type": "string" - }, - "encoding_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Encoding ID", - "type": "integer" - }, - "end_offset": { - "title": "End Offset", - "type": "integer" - }, - "format": { - "title": "Format", - "type": "string" - }, - "format_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Format ID", - "type": "integer" - }, - "sequence_number": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "source_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Source ID", - "type": "integer" - }, - "start_offset": { - "title": "Start Offset", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Packet", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "title": "Process", - "type": "object" - }, - "process_entity": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "score": { - "title": "Reputation Score", - "type": "string" - }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", - "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", - "type": "string" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "span": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Time Span Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "tls": { - "additionalProperties": false, - "properties": { - "alert": { - "title": "Client TLS Alert", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "certificate_chain": { - "items": { - "type": "string" - }, - "title": "Certificate Chain", - "type": "array" - }, - "cipher": { - "title": "Cipher Suite", - "type": "string" - }, - "client_ciphers": { - "items": { - "type": "string" - }, - "title": "Client Cipher Suites", - "type": "array" - }, - "extension_list": { - "items": { - "$ref": "#/$defs/tls_extension" - }, - "title": "Extension List", - "type": "array" - }, - "handshake_dur": { - "title": "Handshake Duration", - "type": "integer" - }, - "ja3_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3 Hash" - }, - "ja3s_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3S Hash" - }, - "key_length": { - "title": "Key Length", - "type": "integer" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "server_ciphers": { - "items": { - "type": "string" - }, - "title": "Server Cipher Suites", - "type": "array" - }, - "sni": { - "title": "Server Name Indication", - "type": "string" - }, - "tls_extension_list": { - "items": { - "$ref": "#/$defs/tls_extension" - }, - "title": "TLS Extension List", - "type": "array" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Transport Layer Security (TLS)", - "type": "object" - }, - "tls_extension": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 5, - 10, - 13, - 14, - 15, - 16, - 18, - 19, - 20, - 21, - 41, - 42, - 43, - 44, - 45, - 47, - 48, - 49, - 50, - 51, - 99 - ], - "title": "Type ID", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "TLS Extension", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "account" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "forward_addr": { - "title": "Forwarding Address", - "type": "string" - }, - "full_name": { - "title": "Full Name", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] - }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" - }, - "exploit_type": { - "title": "Exploit Type", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Vulnerability Details", - "type": "object" - }, - "whois": { - "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" - } - }, - "title": "WHOIS", - "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" - ] - }, - { - "required": [ - "service_start_type_id" - ] - }, - { - "required": [ - "service_type_id" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "service_category": { - "title": "Service Category", - "type": "string" - }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", - "type": "string" - }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", - "type": "integer" - }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" - }, - "service_start_name": { - "title": "Service Start Name", - "type": "string" - }, - "service_start_type": { - "title": "Service Start Type", - "type": "string" - }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", - "type": "string" - }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Windows Service", - "type": "object" - } - }, - "$id": "https://schema.ocsf.io/schema/classes/network_activity", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "dst_endpoint" - ] - }, - { - "required": [ - "src_endpoint" - ] - } - ], - "properties": { - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" - }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Activity ID", - "type": "integer" - }, - "activity_name": { - "title": "Activity", - "type": "string" - }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_protocol_name": { - "title": "Application Protocol Name", - "type": "string" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "category_name": { - "title": "Category", - "type": "string" - }, - "category_uid": { - "const": 4, - "title": "Category ID", - "type": "integer" - }, - "class_name": { - "title": "Class", - "type": "string" - }, - "class_uid": { - "const": 4001, - "title": "Class ID", - "type": "integer" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "confidence_score": { - "title": "Confidence Score", - "type": "integer" - }, - "connection_info": { - "$ref": "#/$defs/network_connection_info", - "title": "Connection Info" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "cumulative_traffic": { - "$ref": "#/$defs/network_traffic", - "title": "Cumulative Traffic" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "disposition": { - "title": "Disposition", - "type": "string" - }, - "disposition_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 99 - ], - "title": "Disposition ID", - "type": "integer" - }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "enrichments": { - "items": { - "$ref": "#/$defs/enrichment" - }, - "title": "Enrichments", - "type": "array" - }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "is_alert": { - "title": "Alert", - "type": "boolean" - }, - "is_src_dst_assignment_known": { - "title": "Source/Destination Assignment Known", - "type": "boolean" - }, - "ja4_fingerprint_list": { - "items": { - "$ref": "#/$defs/ja4_fingerprint" - }, - "title": "JA4+ Fingerprints", - "type": "array" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "network_observation_point": { - "$ref": "#/$defs/network_endpoint", - "title": "Network Observation Point" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "observation_point": { - "title": "Observation Point", - "type": "string" - }, - "observation_point_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Observation Point ID", - "type": "integer" - }, - "packet_list": { - "items": { - "$ref": "#/$defs/packet" - }, - "title": "Packets", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "proxy": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy" - }, - "proxy_connection_info": { - "$ref": "#/$defs/network_connection_info", - "title": "Proxy Connection Info" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "proxy_http_request": { - "$ref": "#/$defs/http_request", - "title": "Proxy HTTP Request" - }, - "proxy_http_response": { - "$ref": "#/$defs/http_response", - "title": "Proxy HTTP Response" - }, - "proxy_tls": { - "$ref": "#/$defs/tls", - "title": "Proxy TLS" - }, - "proxy_traffic": { - "$ref": "#/$defs/network_traffic", - "title": "Proxy Traffic" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" - }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" - }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "timezone_offset": { - "title": "Timezone Offset", - "type": "integer" - }, - "tls": { - "$ref": "#/$defs/tls", - "title": "TLS" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "traffic": { - "$ref": "#/$defs/network_traffic", - "title": "Traffic" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - } - }, - "required": [ - "activity_id", - "category_uid", - "class_uid", - "metadata", - "severity_id", - "time", - "type_uid" - ], - "title": "Network Activity", - "type": "object" -} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/process_activity@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/process_activity@container+host+security_control+trace.json deleted file mode 100644 index 3c12b4a67c..0000000000 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/process_activity@container+host+security_control+trace.json +++ /dev/null @@ -1,7745 +0,0 @@ -{ - "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for process_activity. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", - "$defs": { - "account": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Advisory ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Advisory", - "type": "object" - }, - "affected_code": { - "additionalProperties": false, - "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" - }, - "start_column": { - "title": "Start Column", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "required": [ - "file" - ], - "title": "Affected Code", - "type": "object" - }, - "affected_package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "fixed_in_version": { - "title": "Fixed In Version", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", - "type": "object" - }, - "agent": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Agent Name", - "type": "string" - }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Agent ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate Agent ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Agent Version", - "type": "string" - } - }, - "title": "Agent", - "type": "object" - }, - "ai_model": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ai_provider": { - "title": "AI Provider", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "ai_provider" - ], - "title": "AI Model", - "type": "object" - }, - "analytic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" - }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "operation" - ], - "title": "API", - "type": "object" - }, - "application": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "criticality": { - "title": "Business Criticality", - "type": "string" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Application Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Application Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "resource_relationship": { - "$ref": "#/$defs/graph", - "title": "Application Relationship" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "sbom": { - "$ref": "#/$defs/sbom", - "title": "Related SBOM" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Application Type", - "type": "string" - }, - "uid": { - "title": "Application ID", - "type": "string" - }, - "uid_alt": { - "title": "Application Alternative ID", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Application Version", - "type": "string" - } - }, - "title": "Application", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" - }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "factor_type": { - "title": "Factor Type", - "type": "string" - }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" - }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" - }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - }, - "zone": { - "title": "Cloud Availability Zone", - "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Container", - "type": "object" - }, - "cve": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Vulnerability Type", - "type": "string" - }, - "uid": { - "title": "CVE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "vector_string": { - "title": "Vector String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "CWE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CWE", - "type": "object" - }, - "d3f_tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Technique", - "type": "object" - }, - "d3fend": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], - "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "category_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Category ID", - "type": "integer" - }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Data Classification", - "type": "object" - }, - "device": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "eid": { - "title": "EID", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", - "type": "string" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", - "type": "string" - }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "meid": { - "title": "MEID", - "type": "string" - }, - "model": { - "title": "Model", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "region": { - "title": "Region", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "subnet": { - "title": "Subnet", - "type": "string" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Device", - "type": "object" - }, - "device_hw_info": { - "additionalProperties": false, - "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" - }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", - "type": "string" - }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" - }, - "chassis": { - "title": "Chassis", - "type": "string" - }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" - }, - "cpu_architecture_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" - }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" - }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" - }, - "cpu_type": { - "title": "Processor Type", - "type": "string" - }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", - "type": "integer" - }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" - }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" - }, - "ram_size": { - "title": "RAM Size", - "type": "integer" - }, - "serial_number": { - "title": "Serial Number", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "developer_uid": { - "title": "Developer UID", - "type": "string" - }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "edge": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "relation": { - "title": "Relation", - "type": "string" - }, - "source": { - "title": "Source", - "type": "string" - }, - "target": { - "title": "Target", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "source", - "target" - ], - "title": "Edge", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" - }, - "type": { - "title": "Encryption Type", - "type": "string" - } - }, - "title": "Encryption Details", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "score" - ], - "title": "EPSS", - "type": "object" - }, - "extension": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "drive_type": { - "title": "Drive Type", - "type": "string" - }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, - "name": { - "title": "Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "File", - "type": "object" - }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "condition": { - "title": "Condition", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "match_details": { - "items": { - "type": "string" - }, - "title": "Match Details", - "type": "array" - }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "function_invocation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "error" - ] - }, - { - "required": [ - "parameters" - ] - }, - { - "required": [ - "return_value" - ] - } - ], - "properties": { - "error": { - "title": "Error Code", - "type": "string" - }, - "parameters": { - "items": { - "$ref": "#/$defs/parameter" - }, - "title": "Parameters", - "type": "array" - }, - "return_value": { - "title": "Return Value", - "type": "string" - } - }, - "title": "Function Invocation", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", - "type": "integer" - }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", - "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" - } - }, - "title": "GPU Information", - "type": "object" - }, - "graph": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "edges": { - "items": { - "$ref": "#/$defs/edge" - }, - "title": "Edges", - "type": "array" - }, - "is_directed": { - "title": "Directed", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "nodes": { - "items": { - "$ref": "#/$defs/node" - }, - "title": "Nodes", - "type": "array" - }, - "query_language": { - "title": "Query Language", - "type": "string" - }, - "query_language_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Query Language ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "nodes" - ], - "title": "Graph", - "type": "object" - }, - "group": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" - }, - "type": { - "title": "Group Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "KB Article", - "type": "object" - }, - "key_value_object": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "required": [ - "name" - ], - "title": "Key:Value object", - "type": "object" - }, - "keyboard_info": { - "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "office_location": { - "title": "Office Location", - "type": "string" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "surname": { - "title": "Surname", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" - }, - "city": { - "title": "City", - "type": "string" - }, - "continent": { - "title": "Continent", - "type": "string" - }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" - }, - "geohash": { - "title": "Geohash", - "type": "string" - }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" - }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" - }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", - "type": "object" - }, - "message_context": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "application" - ] - }, - { - "required": [ - "service" - ] - } - ], - "properties": { - "ai_role": { - "title": "AI Role", - "type": "string" - }, - "ai_role_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "AI Role ID", - "type": "integer" - }, - "application": { - "$ref": "#/$defs/application", - "title": "Application" - }, - "completion_tokens": { - "title": "Completion Tokens", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "prompt_tokens": { - "title": "Prompt Tokens", - "type": "integer" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "total_tokens": { - "title": "Total Tokens", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Message Context", - "type": "object" - }, - "metadata": { - "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_source": { - "title": "Log Source", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", - "type": "string" - }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "module": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "function_name" - ] - }, - { - "required": [ - "load_type_id" - ] - } - ], - "properties": { - "base_address": { - "title": "Base Address", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "function_invocation": { - "$ref": "#/$defs/function_invocation", - "title": "Function Invocation" - }, - "function_name": { - "title": "Function Name", - "type": "string" - }, - "load_type": { - "title": "Load Type", - "type": "string" - }, - "load_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Load Type ID", - "type": "integer" - }, - "start_address": { - "title": "Start Address", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "title": "Module", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" - }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "node": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Node", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", - "type": "object" - }, - "observable": { - "additionalProperties": false, - "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", - "type": "string" - }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "title": "Occurrence Details", - "type": "object" - }, - "organization": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Package", - "type": "object" - }, - "parameter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "post_value" - ] - }, - { - "required": [ - "pre_value" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "post_value": { - "title": "Post-Value", - "type": "string" - }, - "pre_value": { - "title": "Pre-Value", - "type": "string" - } - }, - "title": "Parameter", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "title": "Process", - "type": "object" - }, - "process_entity": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "score": { - "title": "Reputation Score", - "type": "string" - }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", - "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", - "type": "string" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "sbom": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "package": { - "$ref": "#/$defs/package", - "title": "Software Package" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "software_components": { - "items": { - "$ref": "#/$defs/software_component" - }, - "title": "Software Components", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "SBOM ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "package", - "software_components" - ], - "title": "Software Bill of Materials", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "software_component": { - "additionalProperties": false, - "properties": { - "author": { - "title": "Author", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "related_component": { - "title": "Related Component", - "type": "string" - }, - "relationship": { - "title": "Relationship", - "type": "string" - }, - "relationship_id": { - "enum": [ - 0, - 1, - 99 - ], - "title": "Relationship ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Component", - "type": "object" - }, - "span": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Time Span Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "account" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "forward_addr": { - "title": "Forwarding Address", - "type": "string" - }, - "full_name": { - "title": "Full Name", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] - }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" - }, - "exploit_type": { - "title": "Exploit Type", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Vulnerability Details", - "type": "object" - }, - "whois": { - "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" - } - }, - "title": "WHOIS", - "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" - ] - }, - { - "required": [ - "service_start_type_id" - ] - }, - { - "required": [ - "service_type_id" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "service_category": { - "title": "Service Category", - "type": "string" - }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", - "type": "string" - }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", - "type": "integer" - }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" - }, - "service_start_name": { - "title": "Service Start Name", - "type": "string" - }, - "service_start_type": { - "title": "Service Start Type", - "type": "string" - }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", - "type": "string" - }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Windows Service", - "type": "object" - } - }, - "$id": "https://schema.ocsf.io/schema/classes/process_activity", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "properties": { - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" - }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Activity ID", - "type": "integer" - }, - "activity_name": { - "title": "Activity", - "type": "string" - }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "actual_permissions": { - "title": "Actual Permissions", - "type": "integer" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "category_name": { - "title": "Category", - "type": "string" - }, - "category_uid": { - "const": 1, - "title": "Category ID", - "type": "integer" - }, - "class_name": { - "title": "Class", - "type": "string" - }, - "class_uid": { - "const": 1007, - "title": "Class ID", - "type": "integer" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "confidence_score": { - "title": "Confidence Score", - "type": "integer" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "disposition": { - "title": "Disposition", - "type": "string" - }, - "disposition_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 99 - ], - "title": "Disposition ID", - "type": "integer" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "enrichments": { - "items": { - "$ref": "#/$defs/enrichment" - }, - "title": "Enrichments", - "type": "array" - }, - "exit_code": { - "title": "Exit Code", - "type": "integer" - }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "injection_type": { - "title": "Injection Type", - "type": "string" - }, - "injection_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Injection Type ID", - "type": "integer" - }, - "is_alert": { - "title": "Alert", - "type": "boolean" - }, - "launch_type": { - "title": "Launch Type", - "type": "string" - }, - "launch_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Launch Type ID", - "type": "integer" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "module": { - "$ref": "#/$defs/module", - "title": "Module" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" - }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" - }, - "requested_permissions": { - "title": "Requested Permissions", - "type": "integer" - }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "timezone_offset": { - "title": "Timezone Offset", - "type": "integer" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" - } - }, - "required": [ - "activity_id", - "actor", - "category_uid", - "class_uid", - "device", - "metadata", - "process", - "severity_id", - "time", - "type_uid" - ], - "title": "Process Activity", - "type": "object" -} diff --git a/crates/openshell-ocsf-validate/schemas/v1.8.0/ssh_activity@container+host+security_control+trace.json b/crates/openshell-ocsf-validate/schemas/v1.8.0/ssh_activity@container+host+security_control+trace.json deleted file mode 100644 index 9bfd95d12f..0000000000 --- a/crates/openshell-ocsf-validate/schemas/v1.8.0/ssh_activity@container+host+security_control+trace.json +++ /dev/null @@ -1,8279 +0,0 @@ -{ - "$comment": "OpenShell extension: OCSF 1.8.0 does not declare the Trace profile for ssh_activity. The optional trace property and its definition closure are copied unchanged from https://schema.ocsf.io/schema/1.8.0/classes/http_activity?profiles=container,host,network_proxy,security_control,trace. All other class constraints are preserved. Regenerate with schemas/update.sh.", - "$defs": { - "account": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "is_disabled": { - "title": "Disabled", - "type": "boolean" - }, - "is_locked": { - "title": "Locked", - "type": "boolean" - }, - "is_on_premises_sync_enabled": { - "title": "On-Premises Sync Enabled", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Account", - "type": "object" - }, - "actor": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "app_name" - ] - }, - { - "required": [ - "app_uid" - ] - }, - { - "required": [ - "invoked_by" - ] - }, - { - "required": [ - "process" - ] - }, - { - "required": [ - "session" - ] - }, - { - "required": [ - "user" - ] - } - ], - "properties": { - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_uid": { - "title": "Application ID", - "type": "string" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "idp": { - "$ref": "#/$defs/idp", - "title": "Identity Provider" - }, - "invoked_by": { - "title": "Invoked by", - "type": "string" - }, - "process": { - "$ref": "#/$defs/process", - "title": "Process" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - } - }, - "title": "Actor", - "type": "object" - }, - "advisory": { - "additionalProperties": false, - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "Related CVEs", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Advisory ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Advisory", - "type": "object" - }, - "affected_code": { - "additionalProperties": false, - "properties": { - "end_column": { - "title": "End Column", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "rule": { - "$ref": "#/$defs/rule", - "title": "Related Rule" - }, - "start_column": { - "title": "Start Column", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "required": [ - "file" - ], - "title": "Affected Code", - "type": "object" - }, - "affected_package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "fixed_in_version": { - "title": "Fixed In Version", - "type": "string" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Affected Software Package", - "type": "object" - }, - "agent": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Agent Name", - "type": "string" - }, - "policies": { - "items": { - "$ref": "#/$defs/policy" - }, - "title": "Agent Policies", - "type": "array" - }, - "type": { - "title": "Agent Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Agent ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate Agent ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Agent Version", - "type": "string" - } - }, - "title": "Agent", - "type": "object" - }, - "analytic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Analytic", - "type": "object" - }, - "api": { - "additionalProperties": false, - "properties": { - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "request": { - "$ref": "#/$defs/request", - "title": "API Request Details" - }, - "response": { - "$ref": "#/$defs/response", - "title": "API Response Details" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "token": { - "$ref": "#/$defs/token", - "title": "Token" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "operation" - ], - "title": "API", - "type": "object" - }, - "attack": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "sub_technique" - ] - }, - { - "required": [ - "tactic" - ] - }, - { - "required": [ - "technique" - ] - } - ], - "properties": { - "mitigation": { - "$ref": "#/$defs/mitigation", - "title": "MITRE Mitigation" - }, - "sub_technique": { - "$ref": "#/$defs/sub_technique", - "title": "MITRE Sub-technique" - }, - "tactic": { - "$ref": "#/$defs/tactic", - "title": "MITRE Tactic" - }, - "tactics": { - "items": { - "$ref": "#/$defs/tactic" - }, - "title": "Tactics", - "type": "array" - }, - "technique": { - "$ref": "#/$defs/technique", - "title": "MITRE Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE ATT&CK\u00ae & ATLAS\u2122", - "type": "object" - }, - "auth_factor": { - "additionalProperties": false, - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "factor_type": { - "title": "Factor Type", - "type": "string" - }, - "factor_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Factor Type ID", - "type": "integer" - }, - "is_hotp": { - "title": "HMAC-based One-time Password (HOTP)", - "type": "boolean" - }, - "is_totp": { - "title": "Time-based One-time Password (TOTP)", - "type": "boolean" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "security_questions": { - "items": { - "type": "string" - }, - "title": "Security Questions", - "type": "array" - } - }, - "required": [ - "factor_type_id" - ], - "title": "Authentication Factor", - "type": "object" - }, - "authorization": { - "additionalProperties": false, - "properties": { - "decision": { - "title": "Authorization Decision/Outcome", - "type": "string" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - } - }, - "title": "Authorization Result", - "type": "object" - }, - "autonomous_system": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "number" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "number": { - "title": "Number", - "type": "integer" - } - }, - "title": "Autonomous System", - "type": "object" - }, - "campaign": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Campaign", - "type": "object" - }, - "certificate": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "is_self_signed": { - "title": "Certificate Self-Signed", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Distinguished Name", - "type": "string" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "serial_number": { - "title": "Certificate Serial Number", - "type": "string" - }, - "subject": { - "title": "Subject Distinguished Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "issuer", - "serial_number" - ], - "title": "Digital Certificate", - "type": "object" - }, - "cis_control": { - "additionalProperties": false, - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "CIS Control", - "type": "object" - }, - "classifier_details": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type" - ], - "title": "Classifier Details", - "type": "object" - }, - "cloud": { - "additionalProperties": false, - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "cloud_partition": { - "title": "Cloud Partition", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "project_uid": { - "title": "Project ID", - "type": "string" - }, - "provider": { - "title": "Cloud Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - }, - "zone": { - "title": "Cloud Availability Zone", - "type": "string" - } - }, - "required": [ - "provider" - ], - "title": "Cloud", - "type": "object" - }, - "container": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "network_driver": { - "title": "Network Driver", - "type": "string" - }, - "orchestrator": { - "title": "Orchestrator", - "type": "string" - }, - "pod_uuid": { - "title": "Pod UUID", - "type": "string" - }, - "runtime": { - "title": "Runtime", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Container", - "type": "object" - }, - "cve": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "cvss": { - "items": { - "$ref": "#/$defs/cvss" - }, - "title": "CVSS Score", - "type": "array" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "cwe_uid": { - "title": "CWE UID", - "type": "string" - }, - "cwe_url": { - "title": "CWE URL", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "epss": { - "$ref": "#/$defs/epss", - "title": "EPSS" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_cwes": { - "items": { - "$ref": "#/$defs/cwe" - }, - "title": "Related CWEs", - "type": "array" - }, - "title": { - "title": "Title", - "type": "string" - }, - "type": { - "title": "Vulnerability Type", - "type": "string" - }, - "uid": { - "title": "CVE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CVE", - "type": "object" - }, - "cvss": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Base Score", - "type": "number" - }, - "depth": { - "enum": [ - "Base", - "Environmental", - "Temporal" - ], - "title": "CVSS Depth", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "overall_score": { - "title": "Overall Score", - "type": "number" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "vector_string": { - "title": "Vector String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "base_score", - "version" - ], - "title": "CVSS Score", - "type": "object" - }, - "cwe": { - "additionalProperties": false, - "properties": { - "caption": { - "title": "Caption", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "CWE ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "CWE", - "type": "object" - }, - "d3f_tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Tactic", - "type": "object" - }, - "d3f_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122 Technique", - "type": "object" - }, - "d3fend": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "d3f_tactic" - ] - }, - { - "required": [ - "d3f_technique" - ] - } - ], - "properties": { - "d3f_tactic": { - "$ref": "#/$defs/d3f_tactic", - "title": "MITRE D3FEND\u2122 Tactic" - }, - "d3f_technique": { - "$ref": "#/$defs/d3f_technique", - "title": "MITRE D3FEND\u2122 Technique" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "MITRE D3FEND\u2122", - "type": "object" - }, - "data_classification": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "category_id" - ] - }, - { - "required": [ - "confidentiality_id" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "category_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Category ID", - "type": "integer" - }, - "classifier_details": { - "$ref": "#/$defs/classifier_details", - "title": "Classifier Details" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "discovery_details": { - "items": { - "$ref": "#/$defs/discovery_details" - }, - "title": "Discovery Details", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_details": { - "items": { - "type": "string" - }, - "title": "Status Details", - "type": "array" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "total": { - "title": "Total", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Data Classification", - "type": "object" - }, - "device": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autoscale_uid": { - "title": "Autoscale UID", - "type": "string" - }, - "boot_time": { - "title": "Boot Time", - "type": "integer" - }, - "boot_uid": { - "title": "Boot UID", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "eid": { - "title": "EID", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "hypervisor": { - "title": "Hypervisor", - "type": "string" - }, - "iccid": { - "title": "ICCID", - "type": "string" - }, - "image": { - "$ref": "#/$defs/image", - "title": "Image" - }, - "imei": { - "title": "IMEI", - "type": "string" - }, - "imei_list": { - "items": { - "type": "string" - }, - "title": "IMEI List", - "type": "array" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "is_backed_up": { - "title": "Back Ups Configured", - "type": "boolean" - }, - "is_compliant": { - "title": "Compliant Device", - "type": "boolean" - }, - "is_managed": { - "title": "Managed Device", - "type": "boolean" - }, - "is_mobile_account_active": { - "title": "Mobile Account Active", - "type": "boolean" - }, - "is_personal": { - "title": "Personal Device", - "type": "boolean" - }, - "is_shared": { - "title": "Shared Device", - "type": "boolean" - }, - "is_supervised": { - "title": "Supervised Device", - "type": "boolean" - }, - "is_trusted": { - "title": "Trusted Device", - "type": "boolean" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "meid": { - "title": "MEID", - "type": "string" - }, - "model": { - "title": "Model", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_interfaces": { - "items": { - "$ref": "#/$defs/network_interface" - }, - "title": "Network Interfaces", - "type": "array" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "os_machine_uuid": { - "title": "OS Machine UUID", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "region": { - "title": "Region", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "subnet": { - "title": "Subnet", - "type": "string" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "udid": { - "title": "Unique Device Identifier", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Device", - "type": "object" - }, - "device_hw_info": { - "additionalProperties": false, - "properties": { - "bios_date": { - "title": "BIOS Date", - "type": "string" - }, - "bios_manufacturer": { - "title": "BIOS Manufacturer", - "type": "string" - }, - "bios_ver": { - "title": "BIOS Version", - "type": "string" - }, - "chassis": { - "title": "Chassis", - "type": "string" - }, - "cpu_architecture": { - "title": "CPU Architecture", - "type": "string" - }, - "cpu_architecture_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "CPU Architecture ID", - "type": "integer" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "cpu_cores": { - "title": "CPU Cores", - "type": "integer" - }, - "cpu_count": { - "title": "CPU Count", - "type": "integer" - }, - "cpu_speed": { - "title": "Processor Speed", - "type": "integer" - }, - "cpu_type": { - "title": "Processor Type", - "type": "string" - }, - "desktop_display": { - "$ref": "#/$defs/display", - "title": "Desktop Display" - }, - "gpu_count": { - "title": "GPU Count", - "type": "integer" - }, - "gpu_info_list": { - "items": { - "$ref": "#/$defs/gpu_info" - }, - "title": "GPU information", - "type": "array" - }, - "keyboard_info": { - "$ref": "#/$defs/keyboard_info", - "title": "Keyboard Information" - }, - "ram_size": { - "title": "RAM Size", - "type": "integer" - }, - "serial_number": { - "title": "Serial Number", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Device Hardware Info", - "type": "object" - }, - "digital_signature": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "developer_uid": { - "title": "Developer UID", - "type": "string" - }, - "digest": { - "$ref": "#/$defs/fingerprint", - "title": "Message Digest" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "State ID", - "type": "integer" - } - }, - "required": [ - "algorithm_id" - ], - "title": "Digital Signature", - "type": "object" - }, - "discovery_details": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "occurrence_details": { - "$ref": "#/$defs/occurrence_details", - "title": "Occurrence Details" - }, - "occurrences": { - "items": { - "$ref": "#/$defs/occurrence_details" - }, - "title": "Occurrences", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "title": "Discovery Details", - "type": "object" - }, - "display": { - "additionalProperties": false, - "properties": { - "color_depth": { - "title": "Color Depth", - "type": "integer" - }, - "physical_height": { - "title": "Physical Height", - "type": "integer" - }, - "physical_orientation": { - "title": "Physical Orientation", - "type": "integer" - }, - "physical_width": { - "title": "Physical Width", - "type": "integer" - }, - "scale_factor": { - "title": "Scale Factor", - "type": "integer" - } - }, - "title": "Display", - "type": "object" - }, - "dns_answer": { - "additionalProperties": false, - "properties": { - "class": { - "title": "Resource Record Class", - "type": "string" - }, - "flag_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "type": "integer" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "DNS Header Flags", - "type": "array" - }, - "packet_uid": { - "title": "Packet UID", - "type": "integer" - }, - "rdata": { - "title": "DNS RData", - "type": "string" - }, - "ttl": { - "title": "TTL", - "type": "integer" - }, - "type": { - "title": "Resource Record Type", - "type": "string" - } - }, - "required": [ - "rdata" - ], - "title": "DNS Answer", - "type": "object" - }, - "domain_contact": { - "additionalProperties": false, - "properties": { - "email_addr": { - "title": "Contact Email", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Contact Location Information" - }, - "name": { - "title": "Name", - "type": "string" - }, - "phone_number": { - "title": "Phone Number", - "type": "string" - }, - "type": { - "title": "Domain Contact Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Domain Contact Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Domain Contact", - "type": "object" - }, - "email": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "from" - ] - }, - { - "required": [ - "to" - ] - } - ], - "properties": { - "cc": { - "items": { - "type": "string" - }, - "title": "Cc", - "type": "array" - }, - "cc_mailboxes": { - "items": { - "type": "string" - }, - "title": "Cc Mailboxes", - "type": "array" - }, - "delivered_to": { - "title": "Delivered To", - "type": "string" - }, - "delivered_to_list": { - "items": { - "type": "string" - }, - "title": "Delivered To List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "from": { - "title": "From", - "type": "string" - }, - "from_list": { - "items": { - "type": "string" - }, - "title": "From List", - "type": "array" - }, - "from_mailbox": { - "title": "From Mailbox", - "type": "string" - }, - "from_mailboxes": { - "items": { - "type": "string" - }, - "title": "From Mailboxes", - "type": "array" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "is_read": { - "title": "Read", - "type": "boolean" - }, - "message_uid": { - "title": "Message UID", - "type": "string" - }, - "raw_header": { - "title": "Raw Header", - "type": "string" - }, - "reply_to": { - "title": "Reply To", - "type": "string" - }, - "reply_to_list": { - "items": { - "type": "string" - }, - "title": "Reply To List", - "type": "array" - }, - "reply_to_mailboxes": { - "items": { - "type": "string" - }, - "title": "Reply To Mailboxes", - "type": "array" - }, - "return_path": { - "title": "Return Path", - "type": "string" - }, - "sender": { - "title": "Sender", - "type": "string" - }, - "sender_mailbox": { - "title": "Sender Mailbox", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "smtp_from": { - "title": "SMTP From", - "type": "string" - }, - "smtp_to": { - "items": { - "type": "string" - }, - "title": "SMTP To", - "type": "array" - }, - "subject": { - "title": "Subject", - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "title": "To", - "type": "array" - }, - "to_mailboxes": { - "items": { - "type": "string" - }, - "title": "To Mailboxes", - "type": "array" - }, - "uid": { - "title": "Email Thread UID", - "type": "string" - }, - "urls": { - "items": { - "$ref": "#/$defs/url" - }, - "title": "URLs", - "type": "array" - }, - "x_originating_ip": { - "items": { - "type": "string" - }, - "title": "X-Originating-IP", - "type": "array" - } - }, - "title": "Email", - "type": "object" - }, - "email_auth": { - "additionalProperties": false, - "properties": { - "dkim": { - "title": "DKIM Status", - "type": "string" - }, - "dkim_domain": { - "title": "DKIM Domain", - "type": "string" - }, - "dkim_signature": { - "title": "DKIM Signature", - "type": "string" - }, - "dmarc": { - "title": "DMARC Status", - "type": "string" - }, - "dmarc_override": { - "title": "DMARC Override", - "type": "string" - }, - "dmarc_policy": { - "title": "DMARC Policy", - "type": "string" - }, - "spf": { - "title": "SPF Status", - "type": "string" - } - }, - "title": "Email Authentication", - "type": "object" - }, - "encryption_details": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Encryption Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Encryption Algorithm ID", - "type": "integer" - }, - "key_length": { - "title": "Encryption Key Length", - "type": "integer" - }, - "key_uid": { - "title": "Key UID", - "type": "string" - }, - "type": { - "title": "Encryption Type", - "type": "string" - } - }, - "title": "Encryption Details", - "type": "object" - }, - "endpoint_connection": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "code" - ] - }, - { - "required": [ - "network_endpoint" - ] - } - ], - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "network_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Network Endpoint" - } - }, - "title": "Endpoint Connection", - "type": "object" - }, - "enrichment": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "short_desc": { - "title": "Short Description", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "data", - "name", - "value" - ], - "title": "Enrichment", - "type": "object" - }, - "environment_variable": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Environment Variable", - "type": "object" - }, - "epss": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "percentile": { - "title": "EPSS Percentile", - "type": "number" - }, - "score": { - "title": "EPPS Score", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "score" - ], - "title": "EPSS", - "type": "object" - }, - "extension": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Schema Extension", - "type": "object" - }, - "feature": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Feature", - "type": "object" - }, - "file": { - "additionalProperties": false, - "properties": { - "accessed_time": { - "title": "Accessed Time", - "type": "integer" - }, - "accessor": { - "$ref": "#/$defs/user", - "title": "Accessor" - }, - "attributes": { - "title": "Attributes", - "type": "integer" - }, - "company_name": { - "title": "Company Name", - "type": "string" - }, - "confidentiality": { - "title": "Confidentiality", - "type": "string" - }, - "confidentiality_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Confidentiality ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "drive_type": { - "title": "Drive Type", - "type": "string" - }, - "drive_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Drive Type ID", - "type": "integer" - }, - "encryption_details": { - "$ref": "#/$defs/encryption_details", - "title": "Encryption Details" - }, - "ext": { - "title": "File Extension", - "type": "string" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "imported_symbols": { - "items": { - "type": "string" - }, - "title": "Imported Symbols", - "type": "array" - }, - "internal_name": { - "title": "Internal Name", - "type": "string" - }, - "is_deleted": { - "title": "Deleted", - "type": "boolean" - }, - "is_encrypted": { - "title": "Encrypted", - "type": "boolean" - }, - "is_readonly": { - "title": "Read-Only", - "type": "boolean" - }, - "is_system": { - "title": "System", - "type": "boolean" - }, - "mime_type": { - "title": "MIME type", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "modifier": { - "$ref": "#/$defs/user", - "title": "Modifier" - }, - "name": { - "title": "Name", - "type": "string" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "parent_folder": { - "title": "Parent Folder", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "security_descriptor": { - "title": "Security Descriptor", - "type": "string" - }, - "signature": { - "$ref": "#/$defs/digital_signature", - "title": "Digital Signature" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Digital Signatures", - "type": "array" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uri": { - "title": "File URI", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "version": { - "title": "Version", - "type": "string" - }, - "volume": { - "title": "Volume", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "File", - "type": "object" - }, - "fingerprint": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "algorithm_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 99 - ], - "title": "Algorithm ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "algorithm_id", - "value" - ], - "title": "Fingerprint", - "type": "object" - }, - "firewall_rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "condition": { - "title": "Condition", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "match_details": { - "items": { - "type": "string" - }, - "title": "Match Details", - "type": "array" - }, - "match_location": { - "title": "Match Location", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "sensitivity": { - "title": "Sensitivity", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Firewall Rule", - "type": "object" - }, - "gpu_info": { - "additionalProperties": false, - "properties": { - "bus_type": { - "title": "Bus Type", - "type": "string" - }, - "bus_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Bus Type ID", - "type": "integer" - }, - "cores": { - "title": "Cores", - "type": "integer" - }, - "model": { - "title": "Model", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vram_mode": { - "title": "VRAM Mode", - "type": "string" - }, - "vram_mode_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "VRAM Mode ID", - "type": "integer" - }, - "vram_size": { - "title": "VRAM Size", - "type": "integer" - } - }, - "title": "GPU Information", - "type": "object" - }, - "group": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "desc": { - "title": "Description", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "privileges": { - "items": { - "type": "string" - }, - "title": "Privileges", - "type": "array" - }, - "type": { - "title": "Group Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "Group", - "type": "object" - }, - "hassh": { - "additionalProperties": false, - "properties": { - "algorithm": { - "title": "Algorithm", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Fingerprint" - } - }, - "required": [ - "fingerprint" - ], - "title": "HASSH", - "type": "object" - }, - "http_header": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "HTTP Header", - "type": "object" - }, - "http_request": { - "additionalProperties": false, - "properties": { - "args": { - "title": "HTTP Arguments", - "type": "string" - }, - "body_length": { - "title": "Request Body Length", - "type": "integer" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "http_method": { - "enum": [ - "CONNECT", - "DELETE", - "GET", - "HEAD", - "OPTIONS", - "PATCH", - "POST", - "PUT", - "TRACE" - ], - "title": "HTTP Method", - "type": "string" - }, - "length": { - "title": "Request Length", - "type": "integer" - }, - "referrer": { - "title": "HTTP Referrer", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url": { - "$ref": "#/$defs/url", - "title": "URL" - }, - "user_agent": { - "title": "HTTP User-Agent", - "type": "string" - }, - "version": { - "title": "HTTP Version", - "type": "string" - }, - "x_forwarded_for": { - "items": { - "type": "string" - }, - "title": "X-Forwarded-For", - "type": "array" - } - }, - "title": "HTTP Request", - "type": "object" - }, - "http_response": { - "additionalProperties": false, - "properties": { - "body_length": { - "title": "Response Body Length", - "type": "integer" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "content_type": { - "title": "HTTP Content Type", - "type": "string" - }, - "http_headers": { - "items": { - "$ref": "#/$defs/http_header" - }, - "title": "HTTP Headers", - "type": "array" - }, - "latency": { - "title": "Latency", - "type": "integer" - }, - "length": { - "title": "Response Length", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "status": { - "title": "Status", - "type": "string" - } - }, - "required": [ - "code" - ], - "title": "HTTP Response", - "type": "object" - }, - "idp": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "auth_factors": { - "items": { - "$ref": "#/$defs/auth_factor" - }, - "title": "Authentication Factors", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprint": { - "$ref": "#/$defs/fingerprint", - "title": "Certificate Fingerprint" - }, - "has_mfa": { - "title": "MFA Enforced", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scim": { - "$ref": "#/$defs/scim", - "title": "SCIM" - }, - "sso": { - "$ref": "#/$defs/sso", - "title": "SSO" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "Configuration URL", - "type": "string" - } - }, - "title": "Identity Provider", - "type": "object" - }, - "image": { - "additionalProperties": false, - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "tag": { - "title": "Image Tag", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Image", - "type": "object" - }, - "ja4_fingerprint": { - "additionalProperties": false, - "properties": { - "section_a": { - "title": "JA4 Section A", - "type": "string" - }, - "section_b": { - "title": "JA4 Section B", - "type": "string" - }, - "section_c": { - "title": "JA4 Section C", - "type": "string" - }, - "section_d": { - "title": "JA4 Section D", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "JA4+ Fingerprint", - "type": "object" - }, - "kb_article": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "src_url" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "avg_timespan": { - "$ref": "#/$defs/timespan", - "title": "Average Timespan" - }, - "bulletin": { - "title": "Patch Bulletin", - "type": "string" - }, - "classification": { - "title": "Classification", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "install_state": { - "title": "Install State", - "type": "string" - }, - "install_state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Install State ID", - "type": "integer" - }, - "is_superseded": { - "title": "The patch is superseded.", - "type": "boolean" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "KB Article", - "type": "object" - }, - "key_value_object": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "value" - ] - }, - { - "required": [ - "values" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - }, - "values": { - "items": { - "type": "string" - }, - "title": "Values", - "type": "array" - } - }, - "required": [ - "name" - ], - "title": "Key:Value object", - "type": "object" - }, - "keyboard_info": { - "additionalProperties": false, - "properties": { - "function_keys": { - "title": "Function Keys", - "type": "integer" - }, - "ime": { - "title": "IME", - "type": "string" - }, - "keyboard_layout": { - "title": "Keyboard Layout", - "type": "string" - }, - "keyboard_subtype": { - "title": "Keyboard Subtype", - "type": "integer" - }, - "keyboard_type": { - "title": "Keyboard Type", - "type": "string" - } - }, - "title": "Keyboard Information", - "type": "object" - }, - "kill_chain_phase": { - "additionalProperties": false, - "properties": { - "phase": { - "title": "Kill Chain Phase", - "type": "string" - }, - "phase_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Kill Chain Phase ID", - "type": "integer" - } - }, - "required": [ - "phase_id" - ], - "title": "Kill Chain Phase", - "type": "object" - }, - "ldap_person": { - "additionalProperties": false, - "properties": { - "cost_center": { - "title": "Cost Center", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "deleted_time": { - "title": "Deleted Time", - "type": "integer" - }, - "department": { - "title": "Department", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "email_addrs": { - "items": { - "type": "string" - }, - "title": "Email Addresses", - "type": "array" - }, - "employee_uid": { - "title": "Employee ID", - "type": "string" - }, - "given_name": { - "title": "Given Name", - "type": "string" - }, - "hire_time": { - "title": "Hire Time", - "type": "integer" - }, - "job_title": { - "title": "Job Title", - "type": "string" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "last_login_time": { - "title": "Last Login", - "type": "integer" - }, - "ldap_cn": { - "title": "LDAP Common Name", - "type": "string" - }, - "ldap_dn": { - "title": "LDAP Distinguished Name", - "type": "string" - }, - "leave_time": { - "title": "Leave Time", - "type": "integer" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "manager": { - "$ref": "#/$defs/user", - "title": "Manager" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "office_location": { - "title": "Office Location", - "type": "string" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "surname": { - "title": "Surname", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - } - }, - "title": "LDAP Person", - "type": "object" - }, - "load_balancer": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification": { - "title": "Classification", - "type": "string" - }, - "code": { - "title": "Response Code", - "type": "integer" - }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "endpoint_connections": { - "items": { - "$ref": "#/$defs/endpoint_connection" - }, - "title": "Endpoint Connections", - "type": "array" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metrics": { - "items": { - "$ref": "#/$defs/metric" - }, - "title": "Metrics", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Load Balancer", - "type": "object" - }, - "location": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "city" - ] - }, - { - "required": [ - "country" - ] - }, - { - "required": [ - "postal_code" - ] - }, - { - "required": [ - "region" - ] - } - ], - "properties": { - "aerial_height": { - "title": "Aerial Height", - "type": "string" - }, - "city": { - "title": "City", - "type": "string" - }, - "continent": { - "title": "Continent", - "type": "string" - }, - "coordinates": { - "items": { - "type": "number" - }, - "title": "Coordinates", - "type": "array" - }, - "country": { - "title": "Country", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "geodetic_altitude": { - "title": "Geodetic Altitude", - "type": "string" - }, - "geodetic_vertical_accuracy": { - "title": "Geodetic Vertical Accuracy", - "type": "string" - }, - "geohash": { - "title": "Geohash", - "type": "string" - }, - "horizontal_accuracy": { - "title": "Horizontal Accuracy", - "type": "string" - }, - "is_on_premises": { - "title": "On-Premises", - "type": "boolean" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "lat": { - "title": "Latitude", - "type": "number" - }, - "long": { - "title": "Longitude", - "type": "number" - }, - "postal_code": { - "title": "Postal Code", - "type": "string" - }, - "pressure_altitude": { - "title": "Pressure Altitude", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "region": { - "title": "Region", - "type": "string" - } - }, - "title": "Geo Location", - "type": "object" - }, - "logger": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "log_format": { - "title": "Log Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Logger", - "type": "object" - }, - "long_string": { - "additionalProperties": false, - "properties": { - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Long String", - "type": "object" - }, - "malware": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "classification_ids": { - "items": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 99 - ], - "type": "integer" - }, - "title": "Classification IDs", - "type": "array" - }, - "classifications": { - "items": { - "type": "string" - }, - "title": "Classifications", - "type": "array" - }, - "cves": { - "items": { - "$ref": "#/$defs/cve" - }, - "title": "CVE List", - "type": "array" - }, - "files": { - "items": { - "$ref": "#/$defs/file" - }, - "title": "Files", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "path": { - "title": "Path", - "type": "string" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "classification_ids" - ], - "title": "Malware", - "type": "object" - }, - "malware_scan_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "end_time": { - "title": "End Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "num_files": { - "title": "Scanned Files", - "type": "integer" - }, - "num_infected": { - "title": "Number of Infected Entities", - "type": "integer" - }, - "num_volumes": { - "title": "Number of Volumes", - "type": "integer" - }, - "size": { - "title": "Size", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Scan UID", - "type": "string" - }, - "unique_malware_count": { - "title": "Unique Malware Count", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "Malware Scan Info", - "type": "object" - }, - "metadata": { - "additionalProperties": false, - "properties": { - "correlation_uid": { - "title": "Correlation UID", - "type": "string" - }, - "debug": { - "items": { - "type": "string" - }, - "title": "Debug Information", - "type": "array" - }, - "event_code": { - "title": "Event Code", - "type": "string" - }, - "extension": { - "$ref": "#/$defs/extension", - "title": "Schema Extension" - }, - "extensions": { - "items": { - "$ref": "#/$defs/extension" - }, - "title": "Schema Extensions", - "type": "array" - }, - "is_truncated": { - "title": "Is Truncated", - "type": "boolean" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "log_format": { - "title": "Log Source Format", - "type": "string" - }, - "log_level": { - "title": "Log Level", - "type": "string" - }, - "log_name": { - "title": "Log Name", - "type": "string" - }, - "log_provider": { - "title": "Log Provider", - "type": "string" - }, - "log_source": { - "title": "Log Source", - "type": "string" - }, - "log_version": { - "title": "Log Version", - "type": "string" - }, - "logged_time": { - "title": "Logged Time", - "type": "integer" - }, - "loggers": { - "items": { - "$ref": "#/$defs/logger" - }, - "title": "Loggers", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "original_event_uid": { - "title": "Original Event ID", - "type": "string" - }, - "original_time": { - "title": "Original Time", - "type": "string" - }, - "processed_time": { - "title": "Processed Time", - "type": "integer" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "profiles": { - "items": { - "type": "string" - }, - "title": "Profiles", - "type": "array" - }, - "reporter": { - "$ref": "#/$defs/reporter", - "title": "Reporter" - }, - "sequence": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "total_queued_duration": { - "$ref": "#/$defs/timespan", - "title": "Total Queued Duration" - }, - "transformation_info_list": { - "items": { - "$ref": "#/$defs/transformation_info" - }, - "title": "Transformation Info", - "type": "array" - }, - "transmit_time": { - "title": "Transmission Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Event UID", - "type": "string" - }, - "untruncated_size": { - "title": "Untruncated Size", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "product", - "version" - ], - "title": "Metadata", - "type": "object" - }, - "metric": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "name", - "value" - ], - "title": "Metric", - "type": "object" - }, - "mitigation": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "countermeasures": { - "items": { - "$ref": "#/$defs/d3fend" - }, - "title": "Countermeasures", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Mitigation", - "type": "object" - }, - "network_connection_info": { - "additionalProperties": false, - "properties": { - "boundary": { - "title": "Boundary", - "type": "string" - }, - "boundary_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 99 - ], - "title": "Boundary ID", - "type": "integer" - }, - "community_uid": { - "title": "Community ID", - "type": "string" - }, - "direction": { - "title": "Direction", - "type": "string" - }, - "direction_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Direction ID", - "type": "integer" - }, - "flag_history": { - "title": "Connection Flag History", - "type": "string" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - }, - "protocol_ver": { - "title": "IP Version", - "type": "string" - }, - "protocol_ver_id": { - "enum": [ - 0, - 4, - 6, - 99 - ], - "title": "IP Version ID", - "type": "integer" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "tcp_flags": { - "title": "TCP Flags", - "type": "integer" - }, - "uid": { - "title": "Connection UID", - "type": "string" - } - }, - "required": [ - "direction_id" - ], - "title": "Network Connection Information", - "type": "object" - }, - "network_endpoint": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Endpoint", - "type": "object" - }, - "network_interface": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "mac" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace": { - "title": "Namespace", - "type": "string" - }, - "open_ports": { - "items": { - "$ref": "#/$defs/port_info" - }, - "title": "Open Ports", - "type": "array" - }, - "subnet_prefix": { - "title": "Subnet Prefix Length", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Network Interface", - "type": "object" - }, - "network_proxy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "domain" - ] - }, - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "instance_uid" - ] - }, - { - "required": [ - "interface_name" - ] - }, - { - "required": [ - "interface_uid" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "svc_name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "agent_list": { - "items": { - "$ref": "#/$defs/agent" - }, - "title": "Agent List", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "fingerprints": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Fingerprints", - "type": "array" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "hw_info": { - "$ref": "#/$defs/device_hw_info", - "title": "Hardware Info" - }, - "instance_uid": { - "title": "Instance ID", - "type": "string" - }, - "interface_name": { - "title": "Network Interface Name", - "type": "string" - }, - "interface_uid": { - "title": "Network Interface ID", - "type": "string" - }, - "intermediate_ips": { - "items": { - "type": "string" - }, - "title": "Intermediate IP Addresses", - "type": "array" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "mac": { - "title": "MAC Address", - "type": "string" - }, - "mac_vendor": { - "title": "MAC Vendor", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "network_scope": { - "title": "Network Scope", - "type": "string" - }, - "network_scope_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Network Scope ID", - "type": "integer" - }, - "os": { - "$ref": "#/$defs/os", - "title": "OS" - }, - "owner": { - "$ref": "#/$defs/user", - "title": "Owner" - }, - "pool": { - "$ref": "#/$defs/group", - "title": "Pool" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "proxy_endpoint": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy Endpoint" - }, - "subnet_uid": { - "title": "Subnet UID", - "type": "string" - }, - "svc_name": { - "title": "Service Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vlan_uid": { - "title": "VLAN", - "type": "string" - }, - "vpc_uid": { - "title": "VPC UID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Network Proxy Endpoint", - "type": "object" - }, - "network_traffic": { - "additionalProperties": false, - "properties": { - "bytes": { - "title": "Total Bytes", - "type": "integer" - }, - "bytes_in": { - "title": "Bytes In", - "type": "integer" - }, - "bytes_missed": { - "title": "Bytes Missed", - "type": "integer" - }, - "bytes_out": { - "title": "Bytes Out", - "type": "integer" - }, - "chunks": { - "title": "Chunks", - "type": "integer" - }, - "chunks_in": { - "title": "Chunks In", - "type": "integer" - }, - "chunks_out": { - "title": "Chunks Out", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "packets": { - "title": "Total Packets", - "type": "integer" - }, - "packets_in": { - "title": "Packets In", - "type": "integer" - }, - "packets_out": { - "title": "Packets Out", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "timespan": { - "$ref": "#/$defs/timespan", - "title": "Time Span" - } - }, - "title": "Network Traffic", - "type": "object" - }, - "object": { - "additionalProperties": true, - "properties": {}, - "title": "Object", - "type": "object" - }, - "observable": { - "additionalProperties": false, - "properties": { - "event_uid": { - "title": "Event UID", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 28, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 39, - 40, - 41, - 42, - 43, - 44, - 45, - 46, - 47, - 48, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "type_id" - ], - "title": "Observable", - "type": "object" - }, - "occurrence_details": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cell_name" - ] - }, - { - "required": [ - "column_name" - ] - }, - { - "required": [ - "column_number" - ] - }, - { - "required": [ - "end_line" - ] - }, - { - "required": [ - "json_path" - ] - }, - { - "required": [ - "page_number" - ] - }, - { - "required": [ - "record_index_in_array" - ] - }, - { - "required": [ - "row_number" - ] - }, - { - "required": [ - "start_line" - ] - } - ], - "properties": { - "cell_name": { - "title": "Cell Name", - "type": "string" - }, - "column_name": { - "title": "Column Name", - "type": "string" - }, - "column_number": { - "title": "Column Number", - "type": "integer" - }, - "end_line": { - "title": "End Line", - "type": "integer" - }, - "json_path": { - "title": "JSON Path", - "type": "string" - }, - "page_number": { - "title": "Page Number", - "type": "integer" - }, - "record_index_in_array": { - "title": "Record Index in Array", - "type": "integer" - }, - "row_number": { - "title": "Row Number", - "type": "integer" - }, - "start_line": { - "title": "Start Line", - "type": "integer" - } - }, - "title": "Occurrence Details", - "type": "object" - }, - "organization": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "ou_name": { - "title": "Org Unit Name", - "type": "string" - }, - "ou_uid": { - "title": "Org Unit ID", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Organization", - "type": "object" - }, - "os": { - "additionalProperties": false, - "properties": { - "build": { - "title": "OS Build", - "type": "string" - }, - "country": { - "title": "Country", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "cpu_bits": { - "title": "CPU Bits", - "type": "integer" - }, - "edition": { - "title": "OS Edition", - "type": "string" - }, - "kernel_release": { - "title": "Kernel Release", - "type": "string" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "sp_name": { - "title": "OS Service Pack", - "type": "string" - }, - "sp_ver": { - "title": "OS Service Pack Version", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 99, - 100, - 101, - 200, - 201, - 300, - 301, - 302, - 400, - 401, - 402 - ], - "title": "Type ID", - "type": "integer" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "type_id" - ], - "title": "Operating System (OS)", - "type": "object" - }, - "osint": { - "additionalProperties": false, - "properties": { - "answers": { - "items": { - "$ref": "#/$defs/dns_answer" - }, - "title": "Related DNS Answers", - "type": "array" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "campaign": { - "$ref": "#/$defs/campaign", - "title": "Campaign" - }, - "category": { - "title": "Category", - "type": "string" - }, - "comment": { - "title": "Analyst Comments", - "type": "string" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "creator": { - "$ref": "#/$defs/user", - "title": "Creator" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "detection_pattern": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type": { - "title": "Detection Pattern", - "type": "string" - }, - "detection_pattern_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Detection Pattern Type ID", - "type": "integer" - }, - "email": { - "$ref": "#/$defs/email", - "title": "Related Email" - }, - "email_auth": { - "$ref": "#/$defs/email_auth", - "title": "Related Email Authentication" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "external_uid": { - "title": "External ID", - "type": "string" - }, - "file": { - "$ref": "#/$defs/file", - "title": "Related File" - }, - "intrusion_sets": { - "items": { - "type": "string" - }, - "title": "Intrusion Sets", - "type": "array" - }, - "kill_chain": { - "items": { - "$ref": "#/$defs/kill_chain_phase" - }, - "title": "Kill Chain", - "type": "array" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "location": { - "$ref": "#/$defs/location", - "title": "Geo Location" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_analytics": { - "items": { - "$ref": "#/$defs/analytic" - }, - "title": "Related Analytics", - "type": "array" - }, - "reputation": { - "$ref": "#/$defs/reputation", - "title": "Reputation Scores" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "script": { - "$ref": "#/$defs/script", - "title": "Related Script Data" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "signatures": { - "items": { - "$ref": "#/$defs/digital_signature" - }, - "title": "Related Digital Signatures", - "type": "array" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Related Subdomains", - "type": "array" - }, - "subnet": { - "title": "Related Subnet", - "type": "string" - }, - "threat_actor": { - "$ref": "#/$defs/threat_actor", - "title": "Threat Actor" - }, - "tlp": { - "enum": [ - "AMBER", - "AMBER STRICT", - "CLEAR", - "GREEN", - "RED", - "WHITE" - ], - "title": "Traffic Light Protocol", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 99 - ], - "title": "Indicator Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uploaded_time": { - "title": "Uploaded Time", - "type": "integer" - }, - "value": { - "title": "Indicator", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "vulnerabilities": { - "items": { - "$ref": "#/$defs/vulnerability" - }, - "title": "Related Vulnerabilities", - "type": "array" - }, - "whois": { - "$ref": "#/$defs/whois", - "title": "WHOIS" - } - }, - "required": [ - "type_id", - "value" - ], - "title": "OSINT", - "type": "object" - }, - "package": { - "additionalProperties": false, - "properties": { - "architecture": { - "title": "Architecture", - "type": "string" - }, - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "epoch": { - "title": "Epoch", - "type": "integer" - }, - "hash": { - "$ref": "#/$defs/fingerprint", - "title": "Hash" - }, - "license": { - "title": "Software License", - "type": "string" - }, - "license_url": { - "title": "Software License URL", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "package_manager": { - "title": "Package Manager", - "type": "string" - }, - "package_manager_url": { - "title": "Package Manager URL", - "type": "string" - }, - "purl": { - "title": "Package URL", - "type": "string" - }, - "release": { - "title": "Software Release Details", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Package UID", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name", - "version" - ], - "title": "Software Package", - "type": "object" - }, - "packet": { - "additionalProperties": false, - "properties": { - "encoding": { - "title": "Encoding", - "type": "string" - }, - "encoding_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Encoding ID", - "type": "integer" - }, - "end_offset": { - "title": "End Offset", - "type": "integer" - }, - "format": { - "title": "Format", - "type": "string" - }, - "format_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Format ID", - "type": "integer" - }, - "sequence_number": { - "title": "Sequence Number", - "type": "integer" - }, - "source": { - "title": "Source", - "type": "string" - }, - "source_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Source ID", - "type": "integer" - }, - "start_offset": { - "title": "Start Offset", - "type": "integer" - }, - "value": { - "title": "Value", - "type": "string" - } - }, - "required": [ - "value" - ], - "title": "Packet", - "type": "object" - }, - "policy": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "type" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "data": { - "title": "Data" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "group": { - "$ref": "#/$defs/group", - "title": "Group" - }, - "is_applied": { - "title": "Applied", - "type": "boolean" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Policy", - "type": "object" - }, - "port_info": { - "additionalProperties": false, - "properties": { - "port": { - "title": "Port", - "type": "integer" - }, - "protocol_name": { - "title": "Protocol Name", - "type": "string" - }, - "protocol_num": { - "title": "Protocol Number", - "type": "integer" - } - }, - "required": [ - "port" - ], - "title": "Port Information", - "type": "object" - }, - "process": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "ancestry": { - "items": { - "$ref": "#/$defs/process_entity" - }, - "title": "Ancestry", - "type": "array" - }, - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "container": { - "$ref": "#/$defs/container", - "title": "Container" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "environment_variables": { - "items": { - "$ref": "#/$defs/environment_variable" - }, - "title": "Environment Variables", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hosted_services": { - "items": { - "$ref": "#/$defs/win_win_service" - }, - "title": "Hosted Services", - "type": "array" - }, - "integrity": { - "title": "Integrity", - "type": "string" - }, - "integrity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Integrity Level", - "type": "integer" - }, - "lineage": { - "items": { - "type": "string" - }, - "title": "Lineage", - "type": "array" - }, - "loaded_modules": { - "items": { - "type": "string" - }, - "title": "Loaded Modules", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "namespace_pid": { - "title": "Namespace PID", - "type": "integer" - }, - "parent_process": { - "$ref": "#/$defs/process", - "title": "Parent Process" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "ptid": { - "title": "Process Thread ID", - "type": "integer" - }, - "sandbox": { - "title": "Sandbox", - "type": "string" - }, - "session": { - "$ref": "#/$defs/session", - "title": "Session" - }, - "terminated_time": { - "title": "Terminated Time", - "type": "integer" - }, - "tid": { - "title": "Thread ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "user": { - "$ref": "#/$defs/user", - "title": "User" - }, - "working_directory": { - "title": "Working Directory", - "type": "string" - }, - "xattributes": { - "$ref": "#/$defs/object", - "title": "Extended Attributes" - } - }, - "title": "Process", - "type": "object" - }, - "process_entity": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "cpid" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "path" - ] - }, - { - "required": [ - "pid" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "cpid": { - "title": "Common Process Identifier", - "type": "string" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "pid": { - "title": "Process ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Process Entity", - "type": "object" - }, - "product": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "cpe_name": { - "title": "The product CPE identifier", - "type": "string" - }, - "feature": { - "$ref": "#/$defs/feature", - "title": "Feature" - }, - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Product", - "type": "object" - }, - "programmatic_credential": { - "additionalProperties": false, - "properties": { - "last_used_time": { - "title": "Last Used Time", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Programmatic Credential", - "type": "object" - }, - "remediation": { - "additionalProperties": false, - "properties": { - "cis_controls": { - "items": { - "$ref": "#/$defs/cis_control" - }, - "title": "CIS Controls", - "type": "array" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - } - }, - "required": [ - "desc" - ], - "title": "Remediation", - "type": "object" - }, - "reporter": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "hostname" - ] - }, - { - "required": [ - "ip" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "hostname": { - "title": "Hostname", - "type": "string" - }, - "ip": { - "title": "IP Address", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "Reporter", - "type": "object" - }, - "reputation": { - "additionalProperties": false, - "properties": { - "base_score": { - "title": "Reputation Score", - "type": "number" - }, - "provider": { - "title": "Provider", - "type": "string" - }, - "score": { - "title": "Reputation Score", - "type": "string" - }, - "score_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 99 - ], - "title": "Reputation Score ID", - "type": "integer" - } - }, - "required": [ - "base_score", - "score_id" - ], - "title": "Reputation", - "type": "object" - }, - "request": { - "additionalProperties": false, - "properties": { - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Request Elements", - "type": "object" - }, - "response": { - "additionalProperties": false, - "properties": { - "code": { - "title": "Response Code", - "type": "integer" - }, - "containers": { - "items": { - "$ref": "#/$defs/container" - }, - "title": "Containers", - "type": "array" - }, - "data": { - "title": "Data" - }, - "error": { - "title": "Error Code", - "type": "string" - }, - "error_message": { - "title": "Error Message", - "type": "string" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "message": { - "title": "Message", - "type": "string" - } - }, - "title": "Response Elements", - "type": "object" - }, - "rule": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "category": { - "title": "Category", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Rule", - "type": "object" - }, - "san": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - } - }, - "required": [ - "name", - "type" - ], - "title": "Subject Alternative Name", - "type": "object" - }, - "scim": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "error_message": { - "title": "Last Error Message", - "type": "string" - }, - "is_group_provisioning_enabled": { - "title": "SCIM Group Provisioning Enabled", - "type": "boolean" - }, - "is_user_provisioning_enabled": { - "title": "SCIM User Provisioning Enabled", - "type": "boolean" - }, - "last_run_time": { - "title": "Last Sync Time", - "type": "integer" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "rate_limit": { - "title": "Rate Limit", - "type": "integer" - }, - "scim_group_schema": { - "title": "SCIM Group Schema" - }, - "scim_user_schema": { - "title": "SCIM User Schema" - }, - "state": { - "title": "State", - "type": "string" - }, - "state_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "State ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "External ID", - "type": "string" - }, - "url_string": { - "title": "SCIM Endpoint URL", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - }, - "version": { - "title": "SCIM Version", - "type": "string" - } - }, - "title": "SCIM", - "type": "object" - }, - "script": { - "additionalProperties": false, - "properties": { - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "hashes": { - "items": { - "$ref": "#/$defs/fingerprint" - }, - "title": "Hashes", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "script_content": { - "$ref": "#/$defs/long_string", - "title": "Script Content" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "script_content", - "type_id" - ], - "title": "Script", - "type": "object" - }, - "service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "title": "Service", - "type": "object" - }, - "session": { - "additionalProperties": false, - "properties": { - "count": { - "title": "Count", - "type": "integer" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "expiration_reason": { - "title": "Expiration Reason", - "type": "string" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_mfa": { - "title": "Multi Factor Authentication", - "type": "boolean" - }, - "is_remote": { - "title": "Remote", - "type": "boolean" - }, - "is_vpn": { - "title": "VPN Session", - "type": "boolean" - }, - "issuer": { - "title": "Issuer Details", - "type": "string" - }, - "terminal": { - "title": "Terminal", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - }, - "uuid": { - "title": "UUID", - "type": "string" - } - }, - "title": "Session", - "type": "object" - }, - "span": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "message": { - "title": "Message", - "type": "string" - }, - "operation": { - "title": "Operation", - "type": "string" - }, - "parent_uid": { - "title": "Parent Unique ID", - "type": "string" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "end_time", - "start_time", - "uid" - ], - "title": "Span", - "type": "object" - }, - "sso": { - "additionalProperties": false, - "properties": { - "auth_protocol": { - "title": "Auth Protocol", - "type": "string" - }, - "auth_protocol_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 99 - ], - "title": "Auth Protocol ID", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "SAML Certificate" - }, - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "duration_mins": { - "title": "SSO Session Duration", - "type": "integer" - }, - "idle_timeout": { - "title": "SSO Idle Timeout", - "type": "integer" - }, - "login_endpoint": { - "title": "SSO Login Endpoint", - "type": "string" - }, - "logout_endpoint": { - "title": "SSO Logout Endpoint", - "type": "string" - }, - "metadata_endpoint": { - "title": "SSO Metadata Endpoint", - "type": "string" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "protocol_name": { - "title": "Supported Protocol", - "type": "string" - }, - "scopes": { - "items": { - "type": "string" - }, - "title": "Scopes", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "vendor_name": { - "title": "Service Provider", - "type": "string" - } - }, - "title": "SSO", - "type": "object" - }, - "sub_technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Sub-technique", - "type": "object" - }, - "tactic": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Tactic", - "type": "object" - }, - "technique": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "src_url": { - "title": "Source URL", - "type": "string" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "title": "MITRE Technique", - "type": "object" - }, - "threat_actor": { - "additionalProperties": false, - "properties": { - "name": { - "title": "Name", - "type": "string" - }, - "type": { - "title": "Threat Actor Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Threat Actor Type ID", - "type": "integer" - } - }, - "required": [ - "name" - ], - "title": "Threat Actor", - "type": "object" - }, - "timespan": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "duration" - ] - }, - { - "required": [ - "duration_days" - ] - }, - { - "required": [ - "duration_hours" - ] - }, - { - "required": [ - "duration_mins" - ] - }, - { - "required": [ - "duration_months" - ] - }, - { - "required": [ - "duration_secs" - ] - }, - { - "required": [ - "duration_weeks" - ] - }, - { - "required": [ - "duration_years" - ] - }, - { - "required": [ - "end_time" - ] - }, - { - "required": [ - "start_time" - ] - } - ], - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "duration_days": { - "title": "Duration Days", - "type": "integer" - }, - "duration_hours": { - "title": "Duration Hours", - "type": "integer" - }, - "duration_mins": { - "title": "Duration Minutes", - "type": "integer" - }, - "duration_months": { - "title": "Duration Months", - "type": "integer" - }, - "duration_secs": { - "title": "Duration Seconds", - "type": "integer" - }, - "duration_weeks": { - "title": "Duration Weeks", - "type": "integer" - }, - "duration_years": { - "title": "Duration Years", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "type": { - "title": "Time Span Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 99 - ], - "title": "Time Span Type ID", - "type": "integer" - } - }, - "title": "Time Span", - "type": "object" - }, - "tls": { - "additionalProperties": false, - "properties": { - "alert": { - "title": "Client TLS Alert", - "type": "integer" - }, - "certificate": { - "$ref": "#/$defs/certificate", - "title": "Certificate" - }, - "certificate_chain": { - "items": { - "type": "string" - }, - "title": "Certificate Chain", - "type": "array" - }, - "cipher": { - "title": "Cipher Suite", - "type": "string" - }, - "client_ciphers": { - "items": { - "type": "string" - }, - "title": "Client Cipher Suites", - "type": "array" - }, - "extension_list": { - "items": { - "$ref": "#/$defs/tls_extension" - }, - "title": "Extension List", - "type": "array" - }, - "handshake_dur": { - "title": "Handshake Duration", - "type": "integer" - }, - "ja3_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3 Hash" - }, - "ja3s_hash": { - "$ref": "#/$defs/fingerprint", - "title": "JA3S Hash" - }, - "key_length": { - "title": "Key Length", - "type": "integer" - }, - "sans": { - "items": { - "$ref": "#/$defs/san" - }, - "title": "Subject Alternative Names", - "type": "array" - }, - "server_ciphers": { - "items": { - "type": "string" - }, - "title": "Server Cipher Suites", - "type": "array" - }, - "sni": { - "title": "Server Name Indication", - "type": "string" - }, - "tls_extension_list": { - "items": { - "$ref": "#/$defs/tls_extension" - }, - "title": "TLS Extension List", - "type": "array" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "version" - ], - "title": "Transport Layer Security (TLS)", - "type": "object" - }, - "tls_extension": { - "additionalProperties": false, - "properties": { - "data": { - "title": "Data" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 5, - 10, - 13, - 14, - 15, - 16, - 18, - 19, - 20, - 21, - 41, - 42, - 43, - 44, - 45, - 47, - 48, - 49, - 50, - 51, - 99 - ], - "title": "Type ID", - "type": "integer" - } - }, - "required": [ - "type_id" - ], - "title": "TLS Extension", - "type": "object" - }, - "token": { - "additionalProperties": false, - "properties": { - "created_time": { - "title": "Created Time", - "type": "integer" - }, - "expiration_time": { - "title": "Expiration Time", - "type": "integer" - }, - "is_renewable": { - "title": "Renewable", - "type": "boolean" - }, - "modified_time": { - "title": "Modified Time", - "type": "integer" - }, - "name": { - "title": "Name", - "type": "string" - }, - "tenant_uid": { - "title": "Tenant UID", - "type": "string" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "zone": { - "title": "Network Zone", - "type": "string" - } - }, - "title": "Token", - "type": "object" - }, - "trace": { - "additionalProperties": false, - "properties": { - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "flags": { - "items": { - "type": "string" - }, - "title": "Flags", - "type": "array" - }, - "service": { - "$ref": "#/$defs/service", - "title": "Service" - }, - "span": { - "$ref": "#/$defs/span", - "title": "Span" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - } - }, - "required": [ - "uid" - ], - "title": "Trace", - "type": "object" - }, - "transformation_info": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "lang": { - "title": "Language", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "product": { - "$ref": "#/$defs/product", - "title": "Product" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Transformation Info", - "type": "object" - }, - "url": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "path" - ] - }, - { - "required": [ - "url_string" - ] - } - ], - "properties": { - "categories": { - "items": { - "type": "string" - }, - "title": "Website Categorization", - "type": "array" - }, - "category_ids": { - "items": { - "enum": [ - 0, - 1, - 3, - 4, - 5, - 6, - 7, - 9, - 11, - 14, - 15, - 16, - 17, - 18, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 29, - 30, - 31, - 32, - 33, - 34, - 35, - 36, - 37, - 38, - 40, - 43, - 44, - 45, - 46, - 47, - 49, - 50, - 51, - 52, - 53, - 54, - 55, - 56, - 57, - 58, - 59, - 60, - 61, - 63, - 64, - 65, - 66, - 67, - 68, - 71, - 83, - 84, - 85, - 86, - 87, - 88, - 89, - 90, - 92, - 93, - 95, - 96, - 97, - 98, - 99, - 101, - 102, - 103, - 106, - 107, - 108, - 109, - 110, - 111, - 112, - 113, - 114, - 118, - 121 - ], - "type": "integer" - }, - "title": "Website Categorization IDs", - "type": "array" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "hostname": { - "title": "Hostname", - "type": "string" - }, - "path": { - "title": "Path", - "type": "string" - }, - "port": { - "title": "Port", - "type": "integer" - }, - "query_string": { - "title": "HTTP Query String", - "type": "string" - }, - "resource_type": { - "title": "Resource Type", - "type": "string" - }, - "scheme": { - "title": "Scheme", - "type": "string" - }, - "subdomain": { - "title": "Subdomain", - "type": "string" - }, - "url_string": { - "title": "URL String", - "type": "string" - } - }, - "title": "Uniform Resource Locator", - "type": "object" - }, - "user": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "account" - ] - }, - { - "required": [ - "name" - ] - }, - { - "required": [ - "uid" - ] - } - ], - "properties": { - "account": { - "$ref": "#/$defs/account", - "title": "Account" - }, - "credential_uid": { - "title": "User Credential ID", - "type": "string" - }, - "display_name": { - "title": "Display Name", - "type": "string" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "email_addr": { - "title": "Email Address", - "type": "string" - }, - "forward_addr": { - "title": "Forwarding Address", - "type": "string" - }, - "full_name": { - "title": "Full Name", - "type": "string" - }, - "groups": { - "items": { - "$ref": "#/$defs/group" - }, - "title": "Groups", - "type": "array" - }, - "has_mfa": { - "title": "MFA Assigned", - "type": "boolean" - }, - "ldap_person": { - "$ref": "#/$defs/ldap_person", - "title": "LDAP Person" - }, - "name": { - "title": "Name", - "type": "string" - }, - "org": { - "$ref": "#/$defs/organization", - "title": "Organization" - }, - "phone_number": { - "title": "Telephone Number", - "type": "string" - }, - "programmatic_credentials": { - "items": { - "$ref": "#/$defs/programmatic_credential" - }, - "title": "Programmatic Credentials", - "type": "array" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "type": { - "title": "Type", - "type": "string" - }, - "type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Type ID", - "type": "integer" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "uid_alt": { - "title": "Alternate ID", - "type": "string" - } - }, - "title": "User", - "type": "object" - }, - "vulnerability": { - "additionalProperties": false, - "oneOf": [ - { - "not": { - "required": [ - "cve", - "cwe" - ] - }, - "required": [ - "advisory" - ] - }, - { - "not": { - "required": [ - "advisory", - "cwe" - ] - }, - "required": [ - "cve" - ] - }, - { - "not": { - "required": [ - "advisory", - "cve" - ] - }, - "required": [ - "cwe" - ] - } - ], - "properties": { - "advisory": { - "$ref": "#/$defs/advisory", - "title": "Security Advisory" - }, - "affected_code": { - "items": { - "$ref": "#/$defs/affected_code" - }, - "title": "Affected Code", - "type": "array" - }, - "affected_packages": { - "items": { - "$ref": "#/$defs/affected_package" - }, - "title": "Affected Software Packages", - "type": "array" - }, - "category": { - "title": "Category", - "type": "string" - }, - "cve": { - "$ref": "#/$defs/cve", - "title": "CVE" - }, - "cwe": { - "$ref": "#/$defs/cwe", - "title": "CWE" - }, - "dependency_chain": { - "title": "Dependency Chain", - "type": "string" - }, - "desc": { - "title": "Description", - "type": "string" - }, - "exploit_last_seen_time": { - "title": "Exploit Last Seen Time", - "type": "integer" - }, - "exploit_ref_url": { - "title": "Exploit URL", - "type": "string" - }, - "exploit_requirement": { - "title": "Exploit Requirement", - "type": "string" - }, - "exploit_type": { - "title": "Exploit Type", - "type": "string" - }, - "first_seen_time": { - "title": "First Seen", - "type": "integer" - }, - "fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "fix_coverage": { - "title": "Fix Coverage", - "type": "string" - }, - "fix_coverage_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Fix Coverage ID", - "type": "integer" - }, - "is_exploit_available": { - "title": "Exploit Availability", - "type": "boolean" - }, - "is_fix_available": { - "title": "Fix Availability", - "type": "boolean" - }, - "kb_article_list": { - "items": { - "$ref": "#/$defs/kb_article" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "kb_articles": { - "items": { - "type": "string" - }, - "title": "Knowledgebase Articles", - "type": "array" - }, - "last_seen_time": { - "title": "Last Seen", - "type": "integer" - }, - "packages": { - "items": { - "$ref": "#/$defs/package" - }, - "title": "Software Packages", - "type": "array" - }, - "references": { - "items": { - "type": "string" - }, - "title": "References", - "type": "array" - }, - "related_vulnerabilities": { - "items": { - "type": "string" - }, - "title": "Related Vulnerability IDs", - "type": "array" - }, - "remediation": { - "$ref": "#/$defs/remediation", - "title": "Remediation Guidance" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "title": { - "title": "Title", - "type": "string" - }, - "vendor_name": { - "title": "Vendor Name", - "type": "string" - } - }, - "title": "Vulnerability Details", - "type": "object" - }, - "whois": { - "additionalProperties": false, - "properties": { - "autonomous_system": { - "$ref": "#/$defs/autonomous_system", - "title": "Autonomous System" - }, - "created_time": { - "title": "Registered At", - "type": "integer" - }, - "dnssec_status": { - "title": "DNSSEC Status", - "type": "string" - }, - "dnssec_status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "DNSSEC Status ID", - "type": "integer" - }, - "domain": { - "title": "Domain", - "type": "string" - }, - "domain_contacts": { - "items": { - "$ref": "#/$defs/domain_contact" - }, - "title": "Domain Contacts", - "type": "array" - }, - "email_addr": { - "title": "Registrar Abuse Email Address", - "type": "string" - }, - "isp": { - "title": "ISP Name", - "type": "string" - }, - "isp_org": { - "title": "ISP Org", - "type": "string" - }, - "last_seen_time": { - "title": "Last Updated At", - "type": "integer" - }, - "name_servers": { - "items": { - "type": "string" - }, - "title": "Name Servers", - "type": "array" - }, - "phone_number": { - "title": "Registrar Abuse Phone Number", - "type": "string" - }, - "registrar": { - "title": "Domain Registrar", - "type": "string" - }, - "status": { - "title": "Domain Status", - "type": "string" - }, - "subdomains": { - "items": { - "type": "string" - }, - "title": "Subdomains", - "type": "array" - }, - "subnet": { - "title": "Subnet Block", - "type": "string" - } - }, - "title": "WHOIS", - "type": "object" - }, - "win_win_service": { - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "cmd_line" - ] - }, - { - "required": [ - "service_category_id" - ] - }, - { - "required": [ - "service_dependencies" - ] - }, - { - "required": [ - "service_error_control_id" - ] - }, - { - "required": [ - "service_start_name" - ] - }, - { - "required": [ - "service_start_type_id" - ] - }, - { - "required": [ - "service_type_id" - ] - } - ], - "properties": { - "cmd_line": { - "title": "Command Line", - "type": "string" - }, - "hosting_process": { - "$ref": "#/$defs/process_entity", - "title": "Hosting Process" - }, - "labels": { - "items": { - "type": "string" - }, - "title": "Labels", - "type": "array" - }, - "load_order_group": { - "title": "Load Order Group", - "type": "string" - }, - "name": { - "title": "Name", - "type": "string" - }, - "service_category": { - "title": "Service Category", - "type": "string" - }, - "service_category_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Service Category ID", - "type": "integer" - }, - "service_dependencies": { - "items": { - "type": "string" - }, - "title": "Service Dependencies", - "type": "array" - }, - "service_dll_file": { - "$ref": "#/$defs/file", - "title": "Service DLL" - }, - "service_error_control": { - "title": "Service Error Control", - "type": "string" - }, - "service_error_control_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Error Control ID", - "type": "integer" - }, - "service_file": { - "$ref": "#/$defs/file", - "title": "Service File" - }, - "service_start_name": { - "title": "Service Start Name", - "type": "string" - }, - "service_start_type": { - "title": "Service Start Type", - "type": "string" - }, - "service_start_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 99 - ], - "title": "Service Start Type ID", - "type": "integer" - }, - "service_type": { - "title": "Service Type", - "type": "string" - }, - "service_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Service Type ID", - "type": "integer" - }, - "tags": { - "items": { - "$ref": "#/$defs/key_value_object" - }, - "title": "Tags", - "type": "array" - }, - "uid": { - "title": "Unique ID", - "type": "string" - }, - "version": { - "title": "Version", - "type": "string" - } - }, - "required": [ - "name" - ], - "title": "Windows Service", - "type": "object" - } - }, - "$id": "https://schema.ocsf.io/schema/classes/ssh_activity", - "$schema": "http://json-schema.org/draft-07/schema#", - "additionalProperties": false, - "anyOf": [ - { - "required": [ - "dst_endpoint" - ] - }, - { - "required": [ - "src_endpoint" - ] - } - ], - "properties": { - "action": { - "title": "Action", - "type": "string" - }, - "action_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Action ID", - "type": "integer" - }, - "activity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 99 - ], - "title": "Activity ID", - "type": "integer" - }, - "activity_name": { - "title": "Activity", - "type": "string" - }, - "actor": { - "$ref": "#/$defs/actor", - "title": "Actor" - }, - "app_name": { - "title": "Application Name", - "type": "string" - }, - "app_protocol_name": { - "title": "Application Protocol Name", - "type": "string" - }, - "attacks": { - "items": { - "$ref": "#/$defs/attack" - }, - "title": "MITRE ATT&CK\u00ae and ATLAS\u2122 Details", - "type": "array" - }, - "auth_type": { - "title": "Authentication Type", - "type": "string" - }, - "auth_type_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Authentication Type ID", - "type": "integer" - }, - "authorizations": { - "items": { - "$ref": "#/$defs/authorization" - }, - "title": "Authorization Information", - "type": "array" - }, - "category_name": { - "title": "Category", - "type": "string" - }, - "category_uid": { - "const": 4, - "title": "Category ID", - "type": "integer" - }, - "class_name": { - "title": "Class", - "type": "string" - }, - "class_uid": { - "const": 4007, - "title": "Class ID", - "type": "integer" - }, - "client_hassh": { - "$ref": "#/$defs/hassh", - "title": "Client HASSH" - }, - "confidence": { - "title": "Confidence", - "type": "string" - }, - "confidence_id": { - "enum": [ - 0, - 1, - 2, - 3, - 99 - ], - "title": "Confidence ID", - "type": "integer" - }, - "confidence_score": { - "title": "Confidence Score", - "type": "integer" - }, - "connection_info": { - "$ref": "#/$defs/network_connection_info", - "title": "Connection Info" - }, - "count": { - "title": "Count", - "type": "integer" - }, - "cumulative_traffic": { - "$ref": "#/$defs/network_traffic", - "title": "Cumulative Traffic" - }, - "device": { - "$ref": "#/$defs/device", - "title": "Device" - }, - "disposition": { - "title": "Disposition", - "type": "string" - }, - "disposition_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 7, - 8, - 9, - 10, - 11, - 12, - 13, - 14, - 15, - 16, - 17, - 18, - 19, - 20, - 21, - 22, - 23, - 24, - 25, - 26, - 27, - 99 - ], - "title": "Disposition ID", - "type": "integer" - }, - "dst_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Destination Endpoint" - }, - "duration": { - "title": "Duration Milliseconds", - "type": "integer" - }, - "end_time": { - "title": "End Time", - "type": "integer" - }, - "enrichments": { - "items": { - "$ref": "#/$defs/enrichment" - }, - "title": "Enrichments", - "type": "array" - }, - "file": { - "$ref": "#/$defs/file", - "title": "File" - }, - "firewall_rule": { - "$ref": "#/$defs/firewall_rule", - "title": "Firewall Rule" - }, - "is_alert": { - "title": "Alert", - "type": "boolean" - }, - "ja4_fingerprint_list": { - "items": { - "$ref": "#/$defs/ja4_fingerprint" - }, - "title": "JA4+ Fingerprints", - "type": "array" - }, - "malware": { - "items": { - "$ref": "#/$defs/malware" - }, - "title": "Malware", - "type": "array" - }, - "malware_scan_info": { - "$ref": "#/$defs/malware_scan_info", - "title": "Malware Scan Info" - }, - "message": { - "title": "Message", - "type": "string" - }, - "metadata": { - "$ref": "#/$defs/metadata", - "title": "Metadata" - }, - "network_observation_point": { - "$ref": "#/$defs/network_endpoint", - "title": "Network Observation Point" - }, - "observables": { - "items": { - "$ref": "#/$defs/observable" - }, - "title": "Observables", - "type": "array" - }, - "observation_point": { - "title": "Observation Point", - "type": "string" - }, - "observation_point_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Observation Point ID", - "type": "integer" - }, - "packet_list": { - "items": { - "$ref": "#/$defs/packet" - }, - "title": "Packets", - "type": "array" - }, - "policy": { - "$ref": "#/$defs/policy", - "title": "Policy" - }, - "protocol_ver": { - "title": "SSH Version", - "type": "string" - }, - "proxy": { - "$ref": "#/$defs/network_proxy", - "title": "Proxy" - }, - "raw_data": { - "title": "Raw Data", - "type": "string" - }, - "raw_data_hash": { - "$ref": "#/$defs/fingerprint", - "title": "Raw Data Hash" - }, - "raw_data_size": { - "title": "Raw Data Size", - "type": "integer" - }, - "risk_details": { - "title": "Risk Details", - "type": "string" - }, - "risk_level": { - "title": "Risk Level", - "type": "string" - }, - "risk_level_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 99 - ], - "title": "Risk Level ID", - "type": "integer" - }, - "risk_score": { - "title": "Risk Score", - "type": "integer" - }, - "server_hassh": { - "$ref": "#/$defs/hassh", - "title": "Server HASSH" - }, - "severity": { - "title": "Severity", - "type": "string" - }, - "severity_id": { - "enum": [ - 0, - 1, - 2, - 3, - 4, - 5, - 6, - 99 - ], - "title": "Severity ID", - "type": "integer" - }, - "src_endpoint": { - "$ref": "#/$defs/network_endpoint", - "title": "Source Endpoint" - }, - "start_time": { - "title": "Start Time", - "type": "integer" - }, - "status": { - "title": "Status", - "type": "string" - }, - "status_code": { - "title": "Status Code", - "type": "string" - }, - "status_detail": { - "title": "Status Detail", - "type": "string" - }, - "status_id": { - "enum": [ - 0, - 1, - 2, - 99 - ], - "title": "Status ID", - "type": "integer" - }, - "time": { - "title": "Event Time", - "type": "integer" - }, - "timezone_offset": { - "title": "Timezone Offset", - "type": "integer" - }, - "tls": { - "$ref": "#/$defs/tls", - "title": "TLS" - }, - "trace": { - "$ref": "#/$defs/trace", - "title": "Trace" - }, - "traffic": { - "$ref": "#/$defs/network_traffic", - "title": "Traffic" - }, - "type_name": { - "title": "Type Name", - "type": "string" - }, - "type_uid": { - "title": "Type ID", - "type": "integer" - }, - "unmapped": { - "$ref": "#/$defs/object", - "title": "Unmapped Data" - } - }, - "required": [ - "activity_id", - "category_uid", - "class_uid", - "metadata", - "severity_id", - "time", - "type_uid" - ], - "title": "SSH Activity", - "type": "object" -} diff --git a/crates/openshell-ocsf/src/events/base_event.rs b/crates/openshell-ocsf/src/events/base_event.rs index e441b11ecb..4e8554f7a8 100644 --- a/crates/openshell-ocsf/src/events/base_event.rs +++ b/crates/openshell-ocsf/src/events/base_event.rs @@ -13,9 +13,9 @@ use crate::objects::{AiModel, Device, Metadata}; /// Every event class embeds this struct via `#[serde(flatten)]`. #[derive(Debug, Clone, PartialEq, Eq, Deserialize)] pub struct BaseEventData { - /// Optional trace correlation from the OCSF producer (Trace profile). - #[serde(default, skip_serializing_if = "Option::is_none")] - pub trace: Option, + /// Trace correlation (Trace profile), written only through `set_trace`. + #[serde(default)] + pub(crate) trace: Option, /// OCSF class UID (e.g., 4001 for Network Activity). pub class_uid: u32, @@ -115,7 +115,9 @@ impl Serialize for BaseEventData { if let Some(ref ai_model) = self.ai_model { map.serialize_entry("ai_model", ai_model)?; } - if let Some(ref trace) = self.trace { + if let Some(ref trace) = self.trace + && crate::trace::accepts_trace(self.class_uid) + { map.serialize_entry("trace", trace)?; } if let Some(ref unmapped) = self.unmapped { @@ -196,7 +198,13 @@ impl BaseEventData { } /// Set trace correlation and add the Trace profile once. - pub fn set_trace(&mut self, trace: crate::TraceCorrelation) { + /// + /// OCSF 1.8.0 declares the Trace profile only for HTTP Activity and API + /// Activity, so other classes ignore it. + pub(crate) fn set_trace(&mut self, trace: crate::TraceCorrelation) { + if !crate::trace::accepts_trace(self.class_uid) { + return; + } self.trace = Some(trace); if !self .metadata diff --git a/crates/openshell-ocsf/src/trace.rs b/crates/openshell-ocsf/src/trace.rs index c8de1c685f..9651e00336 100644 --- a/crates/openshell-ocsf/src/trace.rs +++ b/crates/openshell-ocsf/src/trace.rs @@ -64,8 +64,15 @@ pub fn register_trace_correlation_extractor(extractor: fn() -> Option bool { + matches!(class_uid, 4002 | 6003) +} + pub fn enrich(event: &mut crate::OcsfEvent) { - if event.base().trace.is_none() + if accepts_trace(event.class_uid()) + && event.base().trace.is_none() && let Some(trace) = EXTRACTOR.get().and_then(|extract| extract()) { event.base_mut().set_trace(trace); @@ -123,16 +130,56 @@ mod tests { event.base_mut().set_trace(trace()); let correlated = event.to_json().unwrap(); validate_event(&correlated).unwrap_or_else(|e| panic!("{class} with trace: {e}")); - assert_eq!(correlated["trace"]["uid"], trace().uid()); + if matches!(class, "http_activity" | "api_activity") { + assert_eq!(correlated["trace"]["uid"], trace().uid(), "{class}"); + } else { + assert_eq!(correlated, plain, "{class}"); + } let decoded: OcsfEvent = serde_json::from_value(correlated.clone()).unwrap(); assert_eq!(decoded.to_json().unwrap(), correlated); } } + #[test] + fn deserialized_trace_is_dropped_from_classes_without_the_profile() { + let ctx = builders::test_sandbox_context(); + let (_, event) = builders::sample_events(&ctx) + .into_iter() + .find(|(class, _)| *class == "network_activity") + .unwrap(); + let mut value = event.to_json().unwrap(); + value["trace"] = serde_json::json!({"uid": trace().uid()}); + let decoded: OcsfEvent = serde_json::from_value(value).unwrap(); + assert!(decoded.to_json().unwrap().get("trace").is_none()); + } + + #[test] + fn gateway_api_activity_shapes_validate_with_trace() { + let ctx = builders::test_gateway_context(); + let events = [ + ApiActivityBuilder::new(&ctx, "CreateSandbox").build(), + ApiActivityBuilder::new(&ctx, "CreateSandbox") + .action(ActionId::Denied) + .build(), + ApiActivityBuilder::new(&ctx, "chat.completions") + .ai_model(AiModel::new("model", "provider")) + .build(), + ]; + for mut event in events { + event.base_mut().set_trace(trace()); + let correlated = event.to_json().unwrap(); + validate_event(&correlated).unwrap_or_else(|e| panic!("{correlated}: {e}")); + assert_eq!(correlated["trace"]["uid"], trace().uid()); + } + } + #[test] fn exported_schema_checks_trace_shape_and_declared_profile() { let ctx = builders::test_sandbox_context(); - let mut event = BaseEventBuilder::new(&ctx).build(); + let (_, mut event) = builders::sample_events(&ctx) + .into_iter() + .find(|(class, _)| *class == "http_activity") + .unwrap(); event.base_mut().set_trace(trace()); let mut value = event.to_json().unwrap(); validate_event(&value).unwrap_or_else(|e| panic!("{e}")); diff --git a/crates/openshell-otel/tests/ocsf_correlation.rs b/crates/openshell-otel/tests/ocsf_correlation.rs index f626797129..acf3f1a334 100644 --- a/crates/openshell-otel/tests/ocsf_correlation.rs +++ b/crates/openshell-otel/tests/ocsf_correlation.rs @@ -3,7 +3,10 @@ use std::sync::{Arc, LazyLock, Mutex}; -use openshell_ocsf::{BaseEventBuilder, OcsfJsonlLayer, ocsf_emit}; +use openshell_ocsf::{ + ApiActivityBuilder, AuthenticationBuilder, Endpoint, HttpActivityBuilder, HttpRequest, + NetworkActivityBuilder, OcsfEvent, OcsfJsonlLayer, Service, Url, User, ocsf_emit, +}; use opentelemetry_sdk::trace::{InMemorySpanExporterBuilder, Sampler, SdkTracerProvider}; use tracing_subscriber::prelude::*; @@ -33,12 +36,25 @@ fn capture( capture_route(sampler, active, false) } +fn http_event() -> OcsfEvent { + HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .http_request(HttpRequest::new( + "GET", + Url::new("https", "example.com", "/", 443), + )) + .build() +} + +fn capture_event(build: fn() -> OcsfEvent) -> serde_json::Value { + capture_context(Sampler::AlwaysOn, true, false, None, build).0 +} + fn capture_route( sampler: Sampler, active: bool, routed: bool, ) -> (serde_json::Value, Vec) { - capture_context(sampler, active, routed, None) + capture_context(sampler, active, routed, None, http_event) } fn capture_context( @@ -46,6 +62,7 @@ fn capture_context( active: bool, routed: bool, remote_parent: Option, + build: fn() -> OcsfEvent, ) -> (serde_json::Value, Vec) { LazyLock::force(&SETUP); let exporter = InMemorySpanExporterBuilder::new().build(); @@ -58,26 +75,11 @@ fn capture_context( .with(openshell_otel::layer(&provider, "ocsf-test")) .with(OcsfJsonlLayer::new(Writer(bytes.clone()))); tracing::subscriber::with_default(subscriber, || { - let gateway_request = remote_parent.is_some(); let emit = || { - let ctx = openshell_ocsf::ctx::ctx(); - if gateway_request { - ocsf_emit!( - openshell_ocsf::AuthenticationBuilder::new( - ctx, - openshell_ocsf::User::unidentified(), - openshell_ocsf::Service::new("openshell-gateway"), - ) - .status(openshell_ocsf::StatusId::Failure) - .build() - ); - return; - } - let builder = BaseEventBuilder::new(ctx); if routed { - openshell_ocsf::emit_ocsf_event_routed("test-sandbox", builder.build()); + openshell_ocsf::emit_ocsf_event_routed("test-sandbox", build()); } else { - ocsf_emit!(builder.build()); + ocsf_emit!(build()); } }; if active { @@ -101,7 +103,7 @@ fn capture_context( } #[test] -fn authentication_failure_correlation_can_inherit_sampled_or_unsampled_caller_context() { +fn api_activity_correlation_can_inherit_sampled_or_unsampled_caller_context() { use opentelemetry::trace::{SpanContext, SpanId, TraceFlags, TraceId, TraceState}; let uid = "0af7651916cd43dd8448eb211c80319c"; for sampled in [true, false] { @@ -121,9 +123,9 @@ fn authentication_failure_correlation_can_inherit_sampled_or_unsampled_caller_co true, false, Some(parent), + || ApiActivityBuilder::new(openshell_ocsf::ctx::ctx(), "CreateSandbox").build(), ); - assert_eq!(event["class_uid"], 3002); - assert_eq!(event["status_id"], 2); + assert_eq!(event["class_uid"], 6003); if sampled { assert_eq!(event["trace"]["uid"], uid); assert_eq!(spans.len(), 1); @@ -146,6 +148,23 @@ fn assert_no_trace(value: &serde_json::Value) { ); } +#[test] +fn classes_without_the_trace_profile_stay_uncorrelated() { + assert_no_trace(&capture_event(|| { + NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .dst_endpoint(Endpoint::from_domain("example.com", 443)) + .build() + })); + assert_no_trace(&capture_event(|| { + AuthenticationBuilder::new( + openshell_ocsf::ctx::ctx(), + User::unidentified(), + Service::new("openshell-gateway"), + ) + .build() + })); +} + #[test] fn sampled_active_span_correlates_to_exported_w3c_trace() { let (value, spans) = capture(Sampler::AlwaysOn, true); diff --git a/crates/openshell-supervisor-network/src/l7/middleware.rs b/crates/openshell-supervisor-network/src/l7/middleware.rs index 38612c2bee..9fd6489029 100644 --- a/crates/openshell-supervisor-network/src/l7/middleware.rs +++ b/crates/openshell-supervisor-network/src/l7/middleware.rs @@ -169,23 +169,24 @@ pub fn emit_middleware_uninspectable(ctx: &L7EvalContext, detail: &str, denied: "Uninspectable traffic bypassed middleware (fail_open)" }) .build(); - egress_emit!(denied: denied, event); + egress_emit!(event); } pub fn emit_websocket_preflight_events( ctx: &L7EvalContext, outcome: &openshell_supervisor_middleware::WebSocketPreflightResult, ) { - let mut events = websocket_invocation_events(ctx, &outcome.invocations); - events.extend(websocket_coverage_events(ctx, &outcome.coverage)); - events.extend(websocket_preflight_finding_events(outcome)); - if outcome.session_capacity_exhausted { - events.push(middleware_session_capacity_exhausted_event(ctx)); + emit_websocket_invocations(ctx, &outcome.invocations); + emit_websocket_coverage(ctx, &outcome.coverage); + for event in websocket_preflight_finding_events(outcome) { + egress_emit!(event); } - crate::telemetry::emit_decision(events, None, !outcome.allowed); if outcome.saturated { emit_websocket_saturation(ctx); } + if outcome.session_capacity_exhausted { + emit_middleware_session_capacity_exhausted(ctx); + } } pub(super) fn emit_websocket_coverage( @@ -251,23 +252,20 @@ pub(super) fn emit_websocket_session_start_events( ctx: &L7EvalContext, outcome: &openshell_supervisor_middleware::WebSocketSessionStartOutcome, ) { - crate::telemetry::emit_decision( - websocket_invocation_events(ctx, &outcome.invocations), - None, - !outcome.allowed, - ); + emit_websocket_invocations(ctx, &outcome.invocations); } pub(super) fn emit_websocket_message_events( ctx: &L7EvalContext, outcome: &openshell_supervisor_middleware::WebSocketMessageOutcome, ) { - let mut events = websocket_invocation_events(ctx, &outcome.invocations); - events.extend(websocket_message_finding_events(outcome)); - crate::telemetry::emit_decision(events, None, !outcome.allowed); + emit_websocket_invocations(ctx, &outcome.invocations); if outcome.saturated { emit_websocket_saturation(ctx); } + for event in websocket_message_finding_events(outcome) { + egress_emit!(event); + } } pub(super) fn websocket_preflight_finding_events( @@ -314,11 +312,10 @@ pub(super) fn middleware_finding_events( .collect() } -fn websocket_invocation_events( +fn emit_websocket_invocations( ctx: &L7EvalContext, invocations: &[openshell_supervisor_middleware::WebSocketInvocation], -) -> Vec { - let mut events = Vec::new(); +) { for invocation in invocations { use openshell_supervisor_middleware::WebSocketInvocationOutcome as Outcome; let (action, disposition, severity, status, outcome_name) = match invocation.outcome { @@ -389,7 +386,7 @@ fn websocket_invocation_events( invocation.transformed, )) .build(); - events.push(event); + egress_emit!(event); if invocation.failed { let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(if invocation.outcome == Outcome::FailClosed { @@ -410,7 +407,7 @@ fn websocket_invocation_events( ]) .message("WebSocket middleware stage failed") .build(); - events.push(event); + egress_emit!(event); } if invocation.stage_disabled { let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) @@ -430,10 +427,9 @@ fn websocket_invocation_events( "WebSocket middleware stage stream became unusable and was disabled for this session", ) .build(); - events.push(event); + egress_emit!(event); } } - events } fn emit_websocket_saturation(ctx: &L7EvalContext) { @@ -453,8 +449,8 @@ fn emit_websocket_saturation(ctx: &L7EvalContext) { egress_emit!(event); } -fn middleware_session_capacity_exhausted_event(ctx: &L7EvalContext) -> openshell_ocsf::OcsfEvent { - DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) +fn emit_middleware_session_capacity_exhausted(ctx: &L7EvalContext) { + let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Medium) .finding_info(FindingInfo::new( "openshell.middleware.session_capacity_exhausted", @@ -466,7 +462,8 @@ fn middleware_session_capacity_exhausted_event(ctx: &L7EvalContext) -> openshell ("operation", "websocket_message"), ]) .message("Persistent middleware session admission was refused at process capacity") - .build() + .build(); + egress_emit!(event); } fn middleware_admission_exhausted_event(ctx: &L7EvalContext) -> openshell_ocsf::OcsfEvent { @@ -487,7 +484,7 @@ fn middleware_admission_exhausted_event(ctx: &L7EvalContext) -> openshell_ocsf:: } fn emit_middleware_admission_exhausted(ctx: &L7EvalContext) { - egress_emit!(denied: true, middleware_admission_exhausted_event(ctx)); + egress_emit!(middleware_admission_exhausted_event(ctx)); } /// Largest body-buffering limit across the entries that actually resolved to a @@ -815,7 +812,7 @@ fn emit_middleware_body_unavailable(ctx: &L7EvalContext, denied: bool) { "Request body exceeded middleware inspection cap; passed through (fail_open)" }) .build(); - egress_emit!(denied: denied, event); + egress_emit!(event); } /// Parse the raw header block into middleware-visible headers, preserving @@ -1011,33 +1008,6 @@ mod trace_tests { use super::*; use crate::telemetry::tests::{assert_deny_resolves, exported}; - #[tokio::test(flavor = "multi_thread", worker_threads = 2)] - async fn default_level_middleware_deny_finding_is_inside_exported_deny_span() { - let (events, received) = exported("warn", || { - let ctx = L7EvalContext { - host: "blocked.example".to_string(), - port: 443, - policy_name: "middleware-policy".to_string(), - ..Default::default() - }; - emit_middleware_uninspectable(&ctx, "unknown protocol", true); - }) - .await; - assert_eq!(events.len(), 1); - assert_eq!(events[0]["class_uid"], 2004); - assert_deny_resolves(&events, &received, true); - crate::telemetry::tests::assert_deny_attribute( - &received, - "openshell.policy.name", - "middleware-policy", - ); - crate::telemetry::tests::assert_deny_attribute( - &received, - "server.address", - "blocked.example", - ); - } - fn finding() -> openshell_supervisor_middleware::NamespacedFinding { openshell_supervisor_middleware::NamespacedFinding { middleware: "guard".to_string(), @@ -1065,11 +1035,6 @@ mod trace_tests { assert_eq!(deny_count, usize::from(denied)); if denied { assert_deny_resolves(events, received, true); - assert!( - events - .iter() - .all(|event| event["trace"]["uid"] == events[0]["trace"]["uid"]) - ); } else { assert!(events.iter().all(|event| event.get("trace").is_none())); } @@ -1119,108 +1084,6 @@ mod trace_tests { assert_decision(&events, &received, !allowed); } } - - #[tokio::test(flavor = "multi_thread", worker_threads = 2)] - async fn websocket_outcomes_group_domain_and_findings_with_fail_open_controls() { - use openshell_supervisor_middleware::WebSocketInvocationOutcome as Outcome; - for route in ["preflight", "message", "session-start"] { - for outcome in [ - Outcome::Allow, - Outcome::Deny, - Outcome::FailOpen, - Outcome::FailClosed, - ] { - let denied = matches!(outcome, Outcome::Deny | Outcome::FailClosed); - let (events, received) = exported("warn", || { - let ctx = L7EvalContext::default(); - let invocations = vec![openshell_supervisor_middleware::WebSocketInvocation { - config_name: "guard".to_string(), - implementation: "test/guard".to_string(), - outcome, - sequence: None, - original_size: 0, - replacement_size: None, - transformed: false, - failed: matches!(outcome, Outcome::FailOpen | Outcome::FailClosed), - stage_disabled: outcome == Outcome::FailOpen, - reason_code: None, - }]; - match route { - "preflight" => emit_websocket_preflight_events( - &ctx, - &openshell_supervisor_middleware::WebSocketPreflightResult { - allowed: !denied, - terminal_reason: None, - reason: "test".to_string(), - denial: None, - session: None, - findings: vec![finding()], - metadata: std::collections::BTreeMap::new(), - invocations, - coverage: vec![], - saturated: false, - session_capacity_exhausted: false, - }, - ), - "message" => emit_websocket_message_events( - &ctx, - &openshell_supervisor_middleware::WebSocketMessageOutcome { - allowed: !denied, - reason: "test".to_string(), - payload: String::new(), - findings: vec![finding()], - metadata: std::collections::BTreeMap::new(), - invocations, - denial: None, - saturated: false, - platform_oversize: false, - }, - ), - _ => emit_websocket_session_start_events( - &ctx, - &openshell_supervisor_middleware::WebSocketSessionStartOutcome { - allowed: !denied, - terminal_reason: None, - reason: "test".to_string(), - invocations, - }, - ), - } - tracing::info_span!("test.export-barrier").in_scope(|| {}); - }) - .await; - assert_decision(&events, &received, denied); - } - } - } - - #[tokio::test(flavor = "multi_thread", worker_threads = 2)] - async fn session_capacity_only_traces_fail_closed_refusals() { - for allowed in [true, false] { - let (events, received) = exported("warn", || { - emit_websocket_preflight_events( - &L7EvalContext::default(), - &openshell_supervisor_middleware::WebSocketPreflightResult { - allowed, - terminal_reason: None, - reason: "middleware_session_capacity_exhausted".to_string(), - denial: None, - session: None, - findings: vec![], - metadata: std::collections::BTreeMap::new(), - invocations: vec![], - coverage: vec![], - saturated: false, - session_capacity_exhausted: true, - }, - ); - tracing::info_span!("test.export-barrier").in_scope(|| {}); - }) - .await; - assert_eq!(events.len(), 1); - assert_decision(&events, &received, !allowed); - } - } } #[cfg(test)] diff --git a/crates/openshell-supervisor-network/src/l7/relay.rs b/crates/openshell-supervisor-network/src/l7/relay.rs index 05b5c7de4d..19d362752f 100644 --- a/crates/openshell-supervisor-network/src/l7/relay.rs +++ b/crates/openshell-supervisor-network/src/l7/relay.rs @@ -3816,7 +3816,6 @@ mod trace_tests { .await; assert_eq!(events.len(), 2); assert_eq!(received.spans.len(), 1); - assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); assert_deny_resolves(&events, &received, true); } @@ -3829,7 +3828,9 @@ mod trace_tests { policy_name: "rest-policy".to_string(), ..Default::default() }; - emit_parse_rejection(&ctx, "ambiguous framing", "l7-rest"); + egress_emit!(build_l7_request_event( + &ctx, "GET", "/", "deny", "l7-rest", "denied", None + )); }) .await; assert_eq!(events.len(), 1); diff --git a/crates/openshell-supervisor-network/src/l7/rest.rs b/crates/openshell-supervisor-network/src/l7/rest.rs index e3f458129e..6c5980ed83 100644 --- a/crates/openshell-supervisor-network/src/l7/rest.rs +++ b/crates/openshell-supervisor-network/src/l7/rest.rs @@ -6974,12 +6974,8 @@ mod tests { 1, "one response stop is one exported decision" ); + assert!(terminal.get("trace").is_none()); assert_deny_resolves(&companions, &received, true); - assert!( - companions - .iter() - .all(|event| event["trace"]["uid"] == terminal["trace"]["uid"]) - ); } } } diff --git a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs index 9b54ea9993..2e20e9ee08 100644 --- a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs +++ b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs @@ -2172,20 +2172,15 @@ mod tests { .await; assert!(events.len() >= 2); assert_eq!(received.spans.len(), 1); - assert!( - events - .iter() - .all(|event| event["trace"]["uid"] == events[0]["trace"]["uid"]) - ); assert_deny_resolves(&events, &received, true); } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] - async fn response_terminal_failure_without_diagnostics_still_exports_a_deny_trace() { - use crate::telemetry::tests::{assert_deny_resolves, exported}; + async fn response_terminal_failure_without_diagnostics_has_no_deny_trace() { + use crate::telemetry::tests::exported; - // Exercise the emission boundary directly: platform refusals can lack - // invocation diagnostics, but must retain their terminal failure record. + // Platform refusals can lack invocation diagnostics, but must retain + // their terminal failure record. Without an HTTP record, no deny span. for committed in [false, true] { let (events, received) = exported("warn", || { super::emit_http_response_diagnostics( @@ -2196,6 +2191,7 @@ mod tests { true, Some(committed), ); + tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; @@ -2204,18 +2200,36 @@ mod tests { events[0]["finding_info"]["uid"], "openshell.middleware.http_response_failure" ); - assert_eq!(received.spans.len(), 1); - assert_deny_resolves(&events, &received, true); + assert!(events[0].get("trace").is_none()); + assert!( + received + .spans + .iter() + .all(|span| span.name != "supervisor.egress.deny") + ); } } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn response_diagnostic_findings_create_deny_spans_only_when_delivery_is_denied() { use crate::telemetry::tests::{assert_deny_resolves, exported}; + use openshell_supervisor_middleware::HttpResponseInvocationOutcome; for denied in [false, true] { let (events, received) = exported("warn", || { let diagnostics = openshell_supervisor_middleware::HttpResponseDiagnostics { + invocations: vec![openshell_supervisor_middleware::HttpResponseInvocation { + config_name: "content-guard".to_string(), + implementation: "test/guard".to_string(), + outcome: HttpResponseInvocationOutcome::PassThrough, + sequence: None, + input_size: 0, + output_size: None, + failed: false, + stage_disabled: false, + reason_code: None, + failure_category: None, + }], findings: vec![openshell_supervisor_middleware::NamespacedFinding { middleware: "content-guard".into(), finding: openshell_core::proto::Finding { @@ -2239,11 +2253,11 @@ mod tests { tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; - assert_eq!(events.len(), 1); + assert_eq!(events.len(), 2); if denied { assert_deny_resolves(&events, &received, true); } else { - assert!(events[0].get("trace").is_none()); + assert!(events.iter().all(|event| event.get("trace").is_none())); assert!( !received .spans diff --git a/crates/openshell-supervisor-network/src/l7/websocket.rs b/crates/openshell-supervisor-network/src/l7/websocket.rs index 9f34e2388c..52c19dcb1d 100644 --- a/crates/openshell-supervisor-network/src/l7/websocket.rs +++ b/crates/openshell-supervisor-network/src/l7/websocket.rs @@ -660,7 +660,8 @@ fn emit_credential_endpoint_mismatch(host: &str, port: u16, policy_name: &str) { Some("websocket"), "Provider credential endpoint binding mismatch; WebSocket closed", ); - crate::telemetry::emit_decision([event, finding], None, false); + egress_emit!(event); + egress_emit!(finding); } async fn relay_client_to_server( @@ -1412,30 +1413,8 @@ fn emit_uninspected_credential_denial(host: &str, port: u16, policy_name: &str, )) .build(); let finding = crate::l7::build_uninspected_credential_finding(host, policy_name, surface); - crate::telemetry::emit_decision([event, finding], None, false); -} - -#[cfg(test)] -mod trace_tests { - use super::*; - use crate::telemetry::tests::{assert_deny_resolves, exported}; - - #[tokio::test(flavor = "multi_thread", worker_threads = 2)] - async fn paired_websocket_credential_denial_shares_one_deny_span() { - let (events, received) = exported("warn", || { - emit_uninspected_credential_denial( - "blocked.example", - 443, - "credential-policy", - "websocket", - ); - }) - .await; - assert_eq!(events.len(), 2); - assert_eq!(received.spans.len(), 1); - assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); - assert_deny_resolves(&events, &received, true); - } + egress_emit!(event); + egress_emit!(finding); } fn inspect_websocket_text_message( diff --git a/crates/openshell-supervisor-network/src/proxy.rs b/crates/openshell-supervisor-network/src/proxy.rs index de09b439ea..7b7660972b 100644 --- a/crates/openshell-supervisor-network/src/proxy.rs +++ b/crates/openshell-supervisor-network/src/proxy.rs @@ -727,7 +727,6 @@ async fn preauthorize_transparent_open( if destination.ip() == IpAddr::V4(crate::policy_dns::POLICY_LOCAL_ADDRESS) { if destination.port() != 80 || !has_policy_local { emit_staged_transparent_denial( - None, destination, None, &binary_identity, @@ -752,7 +751,6 @@ async fn preauthorize_transparent_open( }); if let Err(denial) = identity_check { emit_staged_transparent_denial( - None, destination, None, &binary_identity, @@ -782,7 +780,6 @@ async fn preauthorize_transparent_open( Err(error) => { warn!(%destination, %error, "Denied staged transparent connection"); emit_staged_transparent_denial( - None, destination, None, &binary_identity, @@ -821,7 +818,6 @@ async fn preauthorize_transparent_open( ); warn!(%destination, %reason, "Denied staged transparent connection"); emit_staged_transparent_denial( - Some(&connect_span), destination, mapped_host, &binary_identity, @@ -850,7 +846,6 @@ async fn preauthorize_transparent_open( { warn!(%destination, reason = %denial.reason, "Denied staged transparent destination"); emit_staged_transparent_denial( - Some(&connect_span), destination, mapped_host, &binary_identity, @@ -889,7 +884,6 @@ async fn preauthorize_transparent_open( }; warn!(%destination, %reason, "Denied staged transparent connection"); emit_staged_transparent_denial( - Some(&connect_span), destination, mapped_host, &binary_identity, @@ -922,7 +916,6 @@ async fn preauthorize_transparent_open( Err(denial) => { warn!(%destination, reason = %denial.reason, "Denied staged transparent destination"); emit_staged_transparent_denial( - Some(&connect_span), destination, mapped_host, &binary_identity, @@ -949,14 +942,13 @@ async fn preauthorize_transparent_open( } fn emit_staged_transparent_denial( - parent: Option<&tracing::Span>, destination: SocketAddr, mapped_host: Option<&str>, identity: &Result, reason: &str, status_detail: &'static str, ) { - egress_emit!(optional_deny_parent: parent, build_staged_transparent_denial_event( + egress_emit!(build_staged_transparent_denial_event( destination, mapped_host, identity, @@ -1236,7 +1228,7 @@ async fn handle_transparent_tcp_connection( ) { Ok(mapping) => mapping, Err(error) => { - emit_transparent_mapping_denial(None, workload_addr, original, None, error); + emit_transparent_mapping_denial(workload_addr, original, None, error); emit_activity(&activity_tx, true, "transparent_tcp_mapping"); return Ok(()); } @@ -1257,7 +1249,7 @@ async fn handle_transparent_tcp_connection( .map_err(|error| miette::miette!("identity resolution task panicked: {error}"))?; if let NetworkAction::Deny { reason } = &decision.action { - emit_transparent_policy_denial(&connect_span, &decision, workload_addr, &host, port); + emit_transparent_policy_denial(&decision, workload_addr, &host, port); emit_denial( &denial_tx, &host, @@ -1276,7 +1268,6 @@ async fn handle_transparent_tcp_connection( if mapping.record.is_observation() { emit_transparent_mapping_denial( - Some(&connect_span), workload_addr, original, Some(&host), @@ -1295,7 +1286,6 @@ async fn handle_transparent_tcp_connection( relay::pin_policy_generation(&opa_engine, decision.policy_generation) else { emit_transparent_mapping_denial( - Some(&connect_span), workload_addr, original, Some(&host), @@ -1312,13 +1302,7 @@ async fn handle_transparent_tcp_connection( ) { Ok(mapping) => mapping, Err(error) => { - emit_transparent_mapping_denial( - Some(&connect_span), - workload_addr, - original, - Some(&host), - error, - ); + emit_transparent_mapping_denial(workload_addr, original, Some(&host), error); emit_activity(&activity_tx, true, "transparent_tcp_mapping"); return Ok(()); } @@ -1335,7 +1319,7 @@ async fn handle_transparent_tcp_connection( .find(|candidate| mapping.endpoint_ids().any(|mapped| mapped == candidate)); let Some(endpoint_id) = endpoint_id else { let reason = "authorized endpoint did not match DNS correlation"; - emit_transparent_policy_denial(&connect_span, &decision, workload_addr, &host, port); + emit_transparent_policy_denial(&decision, workload_addr, &host, port); emit_denial( &denial_tx, &host, @@ -1375,9 +1359,7 @@ async fn handle_transparent_tcp_connection( ); let middleware_gate = middleware_uninspectable_gate(&opa_engine, &ctx)?; if middleware_gate == crate::l7::middleware::UninspectableTrafficGate::Deny { - connect_span.in_scope(|| { - crate::l7::middleware::emit_middleware_uninspectable(&ctx, "transparent tcp", true); - }); + crate::l7::middleware::emit_middleware_uninspectable(&ctx, "transparent tcp", true); return Ok(()); } if middleware_gate == crate::l7::middleware::UninspectableTrafficGate::BypassWithFinding { @@ -1393,6 +1375,7 @@ async fn handle_transparent_tcp_connection( .inspect_err(|_| egress::mark_error(&dial_span)) .into_diagnostic()?; drop(dial_span); + drop(connect_span); let upstream_socket_peer = upstream.peer_addr().into_diagnostic()?; let (connected_real_destination, dial_mode) = match upstream.connect_target() { Some(upstream_proxy::ConnectTarget::Ip(ip)) => ( @@ -1404,7 +1387,7 @@ async fn handle_transparent_tcp_connection( // validated address set. A hostname-mode CONNECT would make the // corporate proxy resolve again and break that binding. Treat a // future invariant regression as an audited denial, not a panic. - emit_transparent_policy_denial(&connect_span, &decision, workload_addr, &host, port); + emit_transparent_policy_denial(&decision, workload_addr, &host, port); emit_denial( &denial_tx, &host, @@ -1435,7 +1418,6 @@ async fn handle_transparent_tcp_connection( let pid = decision .binary_pid .map_or_else(|| "-".to_string(), |pid| pid.to_string()); - drop(connect_span); egress_emit!(build_transparent_tcp_allow_ocsf_event( TransparentTcpAllowAudit { workload: workload_addr, @@ -1566,7 +1548,6 @@ fn original_destination(stream: &TcpStream) -> std::io::Result { #[cfg(target_os = "linux")] fn emit_transparent_mapping_denial( - parent: Option<&tracing::Span>, workload: SocketAddr, original: SocketAddr, mapped_host: Option<&str>, @@ -1581,7 +1562,7 @@ fn emit_transparent_mapping_denial( | MappingLookupError::InvalidMapping | MappingLookupError::LockPoisoned => "transparent_tcp_destination_denied", }; - egress_emit!(optional_deny_parent: parent, + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -1598,7 +1579,6 @@ fn emit_transparent_mapping_denial( #[cfg(target_os = "linux")] fn emit_transparent_policy_denial( - parent: &tracing::Span, decision: &EgressDecision, workload: SocketAddr, host: &str, @@ -1616,7 +1596,7 @@ fn emit_transparent_policy_denial( let pid = decision .binary_pid .map_or_else(|| "-".to_string(), |pid| pid.to_string()); - egress_emit!(deny_parent: parent, + egress_emit!( NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .activity(ActivityId::Open) .action(ActionId::Denied) @@ -1843,52 +1823,6 @@ fn unsupported_l7_tunnel_protocol_detail( } } -#[allow(clippy::too_many_arguments)] -fn build_unsupported_connect_protocol_event( - peer_addr: SocketAddr, - host: &str, - port: u16, - binary: &str, - pid: &str, - ancestors: &str, - cmdline: &str, - policy: &str, - detail: &str, -) -> openshell_ocsf::OcsfEvent { - NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Open) - .action(ActionId::Denied) - .disposition(DispositionId::Blocked) - .severity(SeverityId::Medium) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(host, port)) - .src_endpoint_addr(peer_addr.ip(), peer_addr.port()) - .actor_process(Process::from_bypass(binary, pid, ancestors).with_cmd_line(cmdline)) - .firewall_rule(policy, "l7") - .message(format!( - "CONNECT_L7 blocked unsupported tunnel protocol for {host}:{port}" - )) - .status_detail(detail) - .build() -} - -fn emit_unsupported_connect_protocol( - ctx: &crate::l7::relay::L7EvalContext, - requirement: InspectionRequirement, - detail: &str, - event: openshell_ocsf::OcsfEvent, -) { - // Both records describe one refusal. Use the domain event's decision - // fields for their shared scope, which exits before the response await. - let scope = crate::telemetry::deny_span(&event, None); - scope.in_scope(|| { - if requirement == InspectionRequirement::RequiredMiddleware { - crate::l7::middleware::emit_middleware_uninspectable(ctx, detail, true); - } - egress_emit!(event); - }); -} - /// Gate for traffic that would bypass L7 inspection entirely: query the /// middleware chain matching this destination and process identity, and /// decide whether raw relay is allowed. Uninspectable traffic is denied when @@ -2434,7 +2368,6 @@ fn build_forward_destination_deny_ocsf_event( #[allow(clippy::too_many_arguments)] async fn deny_connect_destination( client: &mut C, - connect_span: &tracing::Span, denial: &DestinationDenial, peer_addr: SocketAddr, host: &str, @@ -2451,7 +2384,7 @@ where C: TokioAsyncWrite + Unpin, { let detail = destination_denial_detail(denial.kind); - egress_emit!(deny_parent: connect_span, build_connect_destination_deny_ocsf_event( + egress_emit!(build_connect_destination_deny_ocsf_event( denial, peer_addr, host, port, binary, pid, ancestors, cmdline, )); @@ -2963,7 +2896,7 @@ async fn handle_mediated_connection( .message(format!("CONNECT denied {host_lc}:{port}")) .status_detail(&deny_reason) .build(); - egress_emit!(deny_parent: &connect_span, event); + egress_emit!(event); emit_denial( &denial_tx, &host_lc, @@ -3036,7 +2969,6 @@ async fn handle_mediated_connection( } deny_connect_destination( &mut client, - &connect_span, &denial, workload_addr, &host_lc, @@ -3080,7 +3012,6 @@ async fn handle_mediated_connection( } deny_connect_destination( &mut client, - &connect_span, &denial, workload_addr, &host_lc, @@ -3130,7 +3061,7 @@ async fn handle_mediated_connection( )) .status_detail(TLS_TERMINATION_UNAVAILABLE_DETAIL) .build(); - egress_emit!(deny_parent: &connect_span, event); + egress_emit!(event); emit_activity_simple(activity_tx.as_ref(), true, "tls_termination_unavailable"); emit_denial( &denial_tx, @@ -3173,7 +3104,8 @@ async fn handle_mediated_connection( policy_str, if effective_tls_skip { "tls-skip" } else { "l4" }, ); - crate::telemetry::emit_decision([event, finding], Some(&connect_span), false); + egress_emit!(event); + egress_emit!(finding); emit_activity_simple(activity_tx.as_ref(), true, "uninspected_credentials"); emit_denial( &denial_tx, @@ -3474,18 +3406,28 @@ async fn handle_mediated_connection( if let Some(protocol_detail) = unsupported_l7_tunnel_protocol_detail(tunnel_protocol, requirement) { - let event = build_unsupported_connect_protocol_event( - workload_addr, - &host_lc, - port, - &binary_str, - &pid_str, - &ancestors_str, - &cmdline_str, - policy_str, - protocol_detail, - ); - emit_unsupported_connect_protocol(&ctx, requirement, protocol_detail, event); + if requirement == InspectionRequirement::RequiredMiddleware { + crate::l7::middleware::emit_middleware_uninspectable(&ctx, protocol_detail, true); + } + let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Open) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) + .severity(SeverityId::Medium) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(&host_lc, port)) + .src_endpoint_addr(workload_addr.ip(), workload_addr.port()) + .actor_process( + Process::from_bypass(&binary_str, &pid_str, &ancestors_str) + .with_cmd_line(&cmdline_str), + ) + .firewall_rule(policy_str, "l7") + .message(format!( + "CONNECT_L7 blocked unsupported tunnel protocol for {host_lc}:{port}" + )) + .status_detail(protocol_detail) + .build(); + egress_emit!(event); emit_activity_simple(activity_tx.as_ref(), true, "l7_parse_rejection"); emit_denial( &denial_tx, @@ -5879,7 +5821,7 @@ async fn handle_forward_proxy( port, format!("FORWARD rejecting non-canonical request-target: {error}"), ); - egress_emit!(deny_parent: &connect_span, event); + egress_emit!(event); emit_activity_simple(activity_tx, true, "forward_parse_rejection"); respond( client, @@ -6152,7 +6094,7 @@ async fn handle_forward_proxy( port, format!("FORWARD_GRAPHQL_L7 request rejected: {e}"), ); - egress_emit!(deny_parent: &connect_span, event); + egress_emit!(event); emit_activity_simple(activity_tx, true, "l7_parse_rejection"); respond( client, @@ -6204,7 +6146,7 @@ async fn handle_forward_proxy( port, format!("FORWARD_JSONRPC_L7 request rejected: {e}"), ); - egress_emit!(deny_parent: &connect_span, event); + egress_emit!(event); emit_activity_simple(activity_tx, true, "l7_parse_rejection"); respond( client, @@ -6855,7 +6797,7 @@ async fn handle_forward_proxy( "FORWARD upstream connect failed for {host_lc}:{port}: {e}" )) .build(); - egress_emit!(deny_parent: &connect_span, event); + egress_emit!(event); if let Some(session) = middleware_session.take() { session .end(openshell_core::proto::MiddlewareSessionEndReason::UpstreamFailure) diff --git a/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs b/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs index 95598fb8c2..3623b1dbb7 100644 --- a/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs +++ b/crates/openshell-supervisor-network/src/proxy/tests/compatibility.rs @@ -89,7 +89,6 @@ async fn destination_denials_preserve_adapter_specific_wire_contracts() { let (mut app, mut proxy) = tcp_pair().await; deny_connect_destination( &mut proxy, - &tracing::Span::none(), &denial, peer, "target.example", diff --git a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs index 74670af9fe..69bb66c23f 100644 --- a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs +++ b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs @@ -5,111 +5,6 @@ use super::*; use crate::telemetry::tests::{assert_deny_resolves, exported}; use opentelemetry_proto::tonic::common::v1::any_value::Value; -fn emit_staged_policy_deny(debug: bool) { - let intent = EgressIntent::connect("blocked.example".to_string(), 443); - let connect = egress::connect_span(&intent); - assert_eq!(connect.is_disabled(), !debug); - connect.in_scope(|| { - egress::traced_authorization( - intent, - |intent| EgressDecision { - intent, - action: NetworkAction::Deny { - reason: "not permitted".to_string(), - }, - policy_generation: 1, - identity: ProcessIdentityEvidence::Unavailable( - IdentityUnavailableReason::LookupFailed, - ), - endpoint: EndpointDecision::default(), - binary: None, - binary_pid: None, - ancestors: vec![], - cmdline_paths: vec![], - }, - |decision| decision, - ); - }); - // Authorization has exited. The actual staged L4 emission must enter its - // own INFO deny span, retaining the saved DEBUG parent when it is enabled. - emit_staged_transparent_denial( - Some(&connect), - "192.0.2.1:443".parse().unwrap(), - Some("blocked.example"), - &Err(ResolveError::Failed("unavailable".to_string())), - "not permitted", - "transparent_tcp_policy_denied", - ); -} - -#[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn default_level_l4_deny_uid_resolves_to_one_span_root_trace() { - let (events, received) = exported("warn", || emit_staged_policy_deny(false)).await; - assert_eq!(events.len(), 1); - assert_deny_resolves(&events, &received, true); - assert_eq!(received.spans.len(), 1); - assert_eq!(events[0]["class_uid"], 4001); - let attributes = received.spans[0] - .attributes - .iter() - .map(|kv| { - ( - kv.key.as_str(), - kv.value.as_ref().unwrap().value.as_ref().unwrap(), - ) - }) - .collect::>(); - assert_eq!( - attributes["openshell.policy.decision"], - &Value::StringValue("deny".to_string()) - ); - assert_eq!( - attributes["server.address"], - &Value::StringValue("blocked.example".to_string()) - ); - assert_eq!(attributes["server.port"], &Value::IntValue(443)); - assert_eq!( - attributes["openshell.policy.reason"], - &Value::StringValue("transparent_tcp_policy_denied".to_string()) - ); - assert!(!attributes.contains_key("openshell.policy.name")); -} - -#[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn debug_level_deny_retains_connect_and_authorization_trace() { - let (events, received) = exported("debug", || emit_staged_policy_deny(true)).await; - assert_eq!(events.len(), 1); - assert_eq!( - received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .count(), - 1 - ); - assert_deny_resolves(&events, &received, false); - let connect = received - .spans - .iter() - .find(|span| span.name == "supervisor.egress.connect") - .unwrap(); - let deny = received - .spans - .iter() - .find(|span| span.name == "supervisor.egress.deny") - .unwrap(); - let authorize = received - .spans - .iter() - .find(|span| span.name == "supervisor.egress.authorize") - .unwrap(); - assert_eq!(deny.trace_id, connect.trace_id); - assert_eq!(deny.parent_span_id, connect.span_id); - assert_eq!(authorize.parent_span_id, connect.span_id); - assert_eq!(authorize.trace_id, connect.trace_id); - assert_eq!(events[0]["trace"]["uid"], hex::encode(&connect.trace_id)); -} - #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn paired_credential_denial_shares_one_deny_span() { let (events, received) = exported("warn", || { @@ -118,7 +13,6 @@ async fn paired_credential_denial_shares_one_deny_span() { .await; assert_eq!(events.len(), 2); assert_eq!(received.spans.len(), 1); - assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); assert_deny_resolves(&events, &received, true); } @@ -142,15 +36,12 @@ async fn repeated_credential_denials_keep_decision_spans_separate() { .action(ActionId::Allowed) .dst_endpoint(Endpoint::from_domain("allowed.example", 443)) .build(); - crate::telemetry::emit(allowed, None, false); + crate::telemetry::emit(allowed, None); }) .await; assert_eq!(events.len(), 5); assert_deny_resolves(&events[..4], &received, level == "warn"); - for pair in events[..4].chunks_exact(2) { - assert_eq!(pair[0]["trace"]["uid"], pair[1]["trace"]["uid"]); - } assert!(events[4].get("trace").is_none(), "deny context must exit"); let denies = received .spans @@ -178,7 +69,7 @@ async fn repeated_credential_denials_keep_decision_spans_separate() { } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn noncanonical_forward_rejections_have_a_deny_trace() { +async fn network_class_forward_rejections_have_no_deny_trace() { let (events, received) = exported("warn", || { let Err(error) = prepare_forward_target("/%zz", crate::l7::path::CanonicalizeOptions::default()) @@ -190,137 +81,89 @@ async fn noncanonical_forward_rejections_have_a_deny_trace() { 443, format!("FORWARD rejecting non-canonical request-target: {error}") )); + tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; assert_eq!(events.len(), 1); assert_eq!(events[0]["action_id"], 2); - assert_deny_resolves(&events, &received, true); + assert!(events[0].get("trace").is_none()); + assert!( + received + .spans + .iter() + .all(|span| span.name != "supervisor.egress.deny") + ); } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn connect_and_forward_denials_use_the_saved_connect_parent() { +async fn forward_denials_use_the_saved_connect_parent() { for level in ["warn", "debug"] { - for forward in [false, true] { - let (events, received) = exported(level, || { - let intent = EgressIntent::connect("blocked.example".to_string(), 443); - let connect = egress::connect_span(&intent); - let decision = EgressDecision { - intent, - action: NetworkAction::Allow { - matched_policy: None, - }, - policy_generation: 1, - identity: ProcessIdentityEvidence::Available, - endpoint: EndpointDecision::default(), - binary: None, - binary_pid: None, - ancestors: vec![], - cmdline_paths: vec![], - }; - let denial = DestinationDenial { - kind: DestinationDenialKind::InternalAddress, - reason: "private destination".to_string(), - }; - let mut output = Vec::new(); - if forward { - futures::executor::block_on(deny_forward_destination( - &mut output, - &connect, - &denial, - "127.0.0.1:41000".parse().unwrap(), - "POST", - "blocked.example", - 443, - "/", - "curl", - "42", - "-", - "curl", - "forward-policy", - &decision, - None, - None, - )) - .unwrap(); - } else { - futures::executor::block_on(deny_connect_destination( - &mut output, - &connect, - &denial, - "127.0.0.1:41000".parse().unwrap(), - "blocked.example", - 443, - "curl", - "42", - "-", - "curl", - &decision, - &None, - &None, - )) - .unwrap(); - } - assert!(output.starts_with(b"HTTP/1.1 403 Forbidden")); - }) - .await; - assert_eq!(events.len(), 1); - assert_deny_resolves(&events, &received, level == "warn"); - assert_eq!( - received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .count(), - 1 - ); - if level == "debug" { - let connect = received - .spans - .iter() - .find(|span| span.name == "supervisor.egress.connect") - .unwrap(); - let deny = received - .spans - .iter() - .find(|span| span.name == "supervisor.egress.deny") - .unwrap(); - assert_eq!(deny.parent_span_id, connect.span_id); - assert_eq!(events[0]["trace"]["uid"], hex::encode(&connect.trace_id)); - } - } - } -} - -#[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn evaluation_errors_only_trace_enforced_denials() { - for mode in [ - crate::l7::EnforcementMode::Audit, - crate::l7::EnforcementMode::Enforce, - ] { - let (events, received) = exported("warn", || { - egress_emit!(build_forward_l7_evaluation_error( + let (events, received) = exported(level, || { + let intent = EgressIntent::connect("blocked.example".to_string(), 443); + let connect = egress::connect_span(&intent); + let decision = EgressDecision { + intent, + action: NetworkAction::Allow { + matched_policy: None, + }, + policy_generation: 1, + identity: ProcessIdentityEvidence::Available, + endpoint: EndpointDecision::default(), + binary: None, + binary_pid: None, + ancestors: vec![], + cmdline_paths: vec![], + }; + let denial = DestinationDenial { + kind: DestinationDenialKind::InternalAddress, + reason: "private destination".to_string(), + }; + let mut output = Vec::new(); + futures::executor::block_on(deny_forward_destination( + &mut output, + &connect, + &denial, + "127.0.0.1:41000".parse().unwrap(), + "POST", "blocked.example", 443, - mode, - "evaluation unavailable" - )); - tracing::info_span!("test.export-barrier").in_scope(|| {}); + "/", + "curl", + "42", + "-", + "curl", + "forward-policy", + &decision, + None, + None, + )) + .unwrap(); + assert!(output.starts_with(b"HTTP/1.1 403 Forbidden")); }) .await; assert_eq!(events.len(), 1); - if mode == crate::l7::EnforcementMode::Enforce { - assert_eq!(events[0]["action_id"], 2); - assert_deny_resolves(&events, &received, true); - } else { - assert!(events[0].get("trace").is_none()); - assert_eq!( - received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .count(), - 0 - ); + assert_deny_resolves(&events, &received, level == "warn"); + assert_eq!( + received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .count(), + 1 + ); + if level == "debug" { + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + let deny = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.deny") + .unwrap(); + assert_eq!(deny.parent_span_id, connect.span_id); + assert_eq!(events[0]["trace"]["uid"], hex::encode(&connect.trace_id)); } } } @@ -390,7 +233,6 @@ async fn forward_evaluation_error_keeps_the_http_decision_policy_context() { assert_eq!(received.spans.len(), if level == "debug" { 2 } else { 1 }); assert_eq!(http_decision["action_id"], 2); assert_eq!(evaluation_error["action_id"], 2); - assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); assert_deny_resolves(&events, &received, level == "warn"); let attribute = |key: &str| { denies[0] @@ -431,199 +273,3 @@ async fn forward_evaluation_error_keeps_the_http_decision_policy_context() { } } } - -fn unsupported_connect_context() -> crate::l7::relay::L7EvalContext { - crate::l7::relay::L7EvalContext { - host: "blocked.example".to_string(), - port: 443, - policy_name: "connect-policy".to_string(), - ..Default::default() - } -} - -fn emit_unsupported_connect_fixture( - ctx: &crate::l7::relay::L7EvalContext, - requirement: InspectionRequirement, - detail: &str, -) { - // The real CONNECT handler drops its connect span before sending the 200 - // and inspecting the tunnel payload, including when DEBUG is enabled. - drop(egress::connect_span(&EgressIntent::connect( - ctx.host.clone(), - ctx.port, - ))); - let event = build_unsupported_connect_protocol_event( - "127.0.0.1:41000".parse().unwrap(), - &ctx.host, - ctx.port, - "curl", - "42", - "-", - "curl", - &ctx.policy_name, - detail, - ); - emit_unsupported_connect_protocol(ctx, requirement, detail, event); -} - -#[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn unsupported_connect_required_middleware_companions_share_one_deny_scope() { - for level in ["warn", "debug"] { - for payload in [ - crate::l7::rest::HTTP2_PRIOR_KNOWLEDGE_PREFACE, - b"SSH-2.0-OpenSSH\r\n".as_slice(), - ] { - let protocol = peek_tunnel_protocol(&mut tokio::io::BufReader::new(payload)) - .await - .unwrap() - .unwrap(); - let requirement = inspection_requirement( - false, - crate::l7::middleware::UninspectableTrafficGate::Deny, - ); - assert_eq!(requirement, InspectionRequirement::RequiredMiddleware); - let detail = unsupported_l7_tunnel_protocol_detail(protocol, requirement).unwrap(); - let ctx = unsupported_connect_context(); - let (events, received) = exported(level, || { - emit_unsupported_connect_fixture(&ctx, requirement, detail); - }) - .await; - - assert_eq!(events.len(), 2, "one finding and one existing domain event"); - let denies = received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .collect::>(); - assert_eq!( - denies.len(), - 1, - "one unsupported CONNECT decision must export one deny span ({level}, {protocol:?})" - ); - assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); - assert_deny_resolves(&events, &received, true); - assert_eq!(received.spans.len(), if level == "debug" { 2 } else { 1 }); - assert_eq!(events[0]["class_uid"], 2004); - assert_eq!(events[1]["class_uid"], 4001); - assert_eq!(events[1]["action_id"], 2); - assert_eq!(events[1]["disposition_id"], 2); - assert_eq!(events[1]["status_detail"], detail); - assert_eq!(events[1]["firewall_rule"]["name"], ctx.policy_name); - let attribute = |key: &str| { - denies[0] - .attributes - .iter() - .find(|attribute| attribute.key == key) - .and_then(|attribute| attribute.value.as_ref()?.value.as_ref()) - }; - assert_eq!( - attribute("openshell.policy.name"), - Some(&Value::StringValue(ctx.policy_name.clone())) - ); - assert_eq!( - attribute("openshell.policy.reason"), - Some(&Value::StringValue(detail.to_string())) - ); - assert_eq!(attribute("ocsf.class_uid"), Some(&Value::IntValue(4001))); - assert_eq!( - attribute("server.address"), - Some(&Value::StringValue(ctx.host.clone())) - ); - assert_eq!(attribute("server.port"), Some(&Value::IntValue(443))); - } - } -} - -#[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn unsupported_connect_l7_route_keeps_one_domain_record() { - for level in ["warn", "debug"] { - for protocol in [ - TunnelProtocol::H2cPriorKnowledge, - TunnelProtocol::Unsupported, - ] { - let requirement = - inspection_requirement(true, crate::l7::middleware::UninspectableTrafficGate::Deny); - assert_eq!(requirement, InspectionRequirement::L7Route); - let detail = unsupported_l7_tunnel_protocol_detail(protocol, requirement).unwrap(); - let ctx = unsupported_connect_context(); - let (events, received) = exported(level, || { - emit_unsupported_connect_fixture(&ctx, requirement, detail); - }) - .await; - - assert_eq!(events.len(), 1); - assert_eq!(events[0]["class_uid"], 4001); - assert_eq!(events[0]["status_detail"], detail); - assert_deny_resolves(&events, &received, true); - assert_eq!(received.spans.len(), if level == "debug" { 2 } else { 1 }); - } - } -} - -#[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn unsupported_connect_allowed_and_fail_open_controls_do_not_create_denies() { - use crate::l7::middleware::UninspectableTrafficGate; - - for level in ["warn", "debug"] { - for gate in [ - UninspectableTrafficGate::Unrestricted, - UninspectableTrafficGate::BypassWithFinding, - ] { - for protocol in [ - TunnelProtocol::H2cPriorKnowledge, - TunnelProtocol::Unsupported, - ] { - let requirement = inspection_requirement(false, gate); - assert_eq!(requirement, InspectionRequirement::None); - assert!(unsupported_l7_tunnel_protocol_detail(protocol, requirement).is_none()); - let ctx = unsupported_connect_context(); - let (events, received) = exported(level, || { - drop(egress::connect_span(&EgressIntent::connect( - ctx.host.clone(), - ctx.port, - ))); - egress_emit!(build_connect_allow_ocsf_event( - "127.0.0.1:41000".parse().unwrap(), - &ctx.host, - ctx.port, - "curl", - "42", - "-", - "curl", - &ctx.policy_name, - false, - )); - if gate == UninspectableTrafficGate::BypassWithFinding { - crate::l7::middleware::emit_middleware_uninspectable( - &ctx, - "non-http tcp", - false, - ); - } - tracing::info_span!("test.export-barrier").in_scope(|| {}); - }) - .await; - - assert_eq!( - events.len(), - if gate == UninspectableTrafficGate::BypassWithFinding { - 2 - } else { - 1 - } - ); - assert_eq!(events[0]["class_uid"], 4001); - assert_eq!(events[0]["action_id"], 1); - for event in events { - assert!(event.get("trace").is_none()); - } - assert!( - received - .spans - .iter() - .all(|span| span.name != "supervisor.egress.deny") - ); - } - } - } -} diff --git a/crates/openshell-supervisor-network/src/telemetry.rs b/crates/openshell-supervisor-network/src/telemetry.rs index 02fb137133..e353a46e6f 100644 --- a/crates/openshell-supervisor-network/src/telemetry.rs +++ b/crates/openshell-supervisor-network/src/telemetry.rs @@ -5,29 +5,15 @@ use openshell_ocsf::{ActionId, OcsfEvent}; -/// Emit egress events inside an INFO deny span. `denied:` supplies the decision -/// for findings without an action; domain events carry their own action. +/// Emit egress events, entering an INFO deny span for denied HTTP Activity. /// A saved connect span parents denies after authorization exits. macro_rules! egress_emit { ($event:expr) => { - $crate::telemetry::emit($event, None, false) + $crate::telemetry::emit($event, None) }; (deny_parent: $parent:expr, $event:expr) => { - $crate::telemetry::emit($event, Some($parent), false) + $crate::telemetry::emit($event, Some($parent)) }; - (deny_parent: $parent:expr, denied: $denied:expr, $event:expr) => {{ - // Evaluate the decision before moving the event it may inspect. - let denied = $denied; - $crate::telemetry::emit($event, Some($parent), denied) - }}; - (optional_deny_parent: $parent:expr, $event:expr) => { - $crate::telemetry::emit($event, $parent, false) - }; - (denied: $denied:expr, $event:expr) => {{ - // Evaluate the decision before moving the event it may inspect. - let denied = $denied; - $crate::telemetry::emit($event, None, denied) - }}; } pub(crate) use egress_emit; @@ -40,8 +26,14 @@ fn is_denied(event: &OcsfEvent) -> bool { } } -pub fn emit(event: OcsfEvent, parent: Option<&tracing::Span>, denied: bool) { - if !denied && !is_denied(&event) { +/// Only HTTP Activity carries `trace`, so only a decision with an HTTP record +/// gets a deny span that an OCSF record can point to. +fn is_http(event: &OcsfEvent) -> bool { + matches!(event, OcsfEvent::HttpActivity(_)) +} + +pub fn emit(event: OcsfEvent, parent: Option<&tracing::Span>) { + if !is_http(&event) || !is_denied(&event) { openshell_ocsf::ocsf_emit!(event); return; } @@ -57,11 +49,11 @@ pub fn emit_decision( denied: bool, ) { let events: Vec<_> = events.into_iter().collect(); - let primary = events + let denied = denied || events.iter().any(is_denied); + let span = events .iter() - .find(|event| is_denied(event)) - .or_else(|| if denied { events.first() } else { None }); - let span = primary.map(|event| deny_span(event, parent)); + .find(|event| denied && is_http(event)) + .map(|event| deny_span(event, parent)); let emit = || { for event in events { openshell_ocsf::ocsf_emit!(event); @@ -85,26 +77,12 @@ pub fn deny_span(event: &OcsfEvent, parent: Option<&tracing::Span>) -> tracing:: return current; } let (endpoint, policy) = match event { - OcsfEvent::NetworkActivity(e) => (e.dst_endpoint.as_ref(), e.firewall_rule.as_ref()), OcsfEvent::HttpActivity(e) => (e.dst_endpoint.as_ref(), e.firewall_rule.as_ref()), _ => (None, None), }; - - // Finding evidence supplies decision fields, not a trace parent. - let evidence = |key: &str| match event { - OcsfEvent::DetectionFinding(e) => e.evidences.as_ref().and_then(|items| { - items - .iter() - .find_map(|item| item.data.as_ref()?.get(key)?.as_str()) - }), - _ => None, - }; - let policy = policy - .map(|rule| rule.name.as_str()) - .or_else(|| evidence("policy")); - let address = endpoint - .and_then(|endpoint| endpoint.domain.as_deref().or(endpoint.ip.as_deref())) - .or_else(|| evidence("host")); + let policy = policy.map(|rule| rule.name.as_str()); + let address = + endpoint.and_then(|endpoint| endpoint.domain.as_deref().or(endpoint.ip.as_deref())); let port = endpoint.and_then(|endpoint| endpoint.port); let reason = event.base().status_detail.as_deref(); let parent = parent.cloned().unwrap_or_else(tracing::Span::current); diff --git a/crates/openshell-supervisor-network/src/telemetry/tests.rs b/crates/openshell-supervisor-network/src/telemetry/tests.rs index dc22af1c7b..29c124e4bb 100644 --- a/crates/openshell-supervisor-network/src/telemetry/tests.rs +++ b/crates/openshell-supervisor-network/src/telemetry/tests.rs @@ -69,8 +69,15 @@ pub async fn exported( pub fn assert_deny_resolves(events: &[serde_json::Value], received: &ReceivedTraces, root: bool) { use opentelemetry_proto::tonic::common::v1::any_value::Value; - assert!(!events.is_empty()); + assert!(events.iter().any(|event| event["class_uid"] == 4002)); for event in events { + if event["class_uid"] != 4002 { + assert!( + event.get("trace").is_none(), + "only HTTP Activity carries trace" + ); + continue; + } let uid = event["trace"]["uid"] .as_str() .expect("emission was inside sampled deny span"); @@ -120,6 +127,19 @@ pub fn assert_deny_resolves(events: &[serde_json::Value], received: &ReceivedTra } } +pub fn http_deny(host: &str, decision: &str) -> openshell_ocsf::OcsfEvent { + openshell_ocsf::HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .http_request(openshell_ocsf::HttpRequest::new( + "GET", + openshell_ocsf::Url::new("https", host, "/", 443), + )) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain(host, 443)) + .status_detail(decision) + .message(decision) + .build() +} + pub fn assert_deny_attribute(received: &ReceivedTraces, key: &str, expected: &str) { use opentelemetry_proto::tonic::common::v1::any_value::Value; let deny = received @@ -141,25 +161,18 @@ pub fn assert_deny_attribute(received: &ReceivedTraces, key: &str, expected: &st #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn companion_emissions_reuse_an_active_decision_scope() { let (events, received) = exported("warn", || { - let event = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .action(openshell_ocsf::ActionId::Denied) - .dst_endpoint(openshell_ocsf::Endpoint::from_domain( - "blocked.example", - 443, - )) - .build(); + let event = http_deny("blocked.example", "denied"); let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()).build(); let scope = super::deny_span(&event, None); scope.in_scope(|| { - super::emit(event, None, false); - super::emit(finding, None, true); + super::emit(event, None); + super::emit(finding, None); }); }) .await; assert_eq!(events.len(), 2); assert_eq!(received.spans.len(), 1); - assert_eq!(events[0]["trace"]["uid"], events[1]["trace"]["uid"]); assert_deny_resolves(&events, &received, true); } @@ -184,14 +197,7 @@ async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { connect.in_scope(|| { for attempt in 0..2 { let decision = format!("{host}:{attempt}"); - let event = openshell_ocsf::NetworkActivityBuilder::new( - openshell_ocsf::ctx::ctx(), - ) - .action(openshell_ocsf::ActionId::Denied) - .dst_endpoint(openshell_ocsf::Endpoint::from_domain(host, 443)) - .status_detail(&decision) - .message(&decision) - .build(); + let event = http_deny(host, &decision); let finding = openshell_ocsf::DetectionFindingBuilder::new( openshell_ocsf::ctx::ctx(), ) @@ -199,11 +205,11 @@ async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { .build(); let scope = super::deny_span(&event, None); scope.in_scope(|| { - super::emit(event, None, false); + super::emit(event, None); // Both threads keep different deny scopes entered // while their companion records interleave. barrier.wait(); - super::emit(finding, None, true); + super::emit(finding, None); barrier.wait(); }); } @@ -250,10 +256,16 @@ async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { .collect::>(); assert_eq!(pair.len(), 2); for event in &pair { - assert_eq!(event["container"]["uid"], host); - assert_eq!(event["container"]["name"], format!("sandbox-{host}")); + assert_eq!(event["device"]["container"]["uid"], host); + assert_eq!( + event["device"]["container"]["name"], + format!("sandbox-{host}") + ); } - assert_eq!(pair[0]["trace"]["uid"], pair[1]["trace"]["uid"]); + let http = pair + .iter() + .find(|event| event["class_uid"] == 4002) + .unwrap(); let spans = denies .iter() .filter(|span| attribute(span, "openshell.policy.reason") == decision) @@ -261,7 +273,7 @@ async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { assert_eq!(spans.len(), 1); let deny = spans[0]; assert_eq!(attribute(deny, "server.address"), host); - assert_eq!(pair[0]["trace"]["uid"], hex::encode(&deny.trace_id)); + assert_eq!(http["trace"]["uid"], hex::encode(&deny.trace_id)); if level == "debug" { let connect = received .spans @@ -294,27 +306,20 @@ async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn missing_deny_context_leaves_optional_attributes_unset() { let (events, received) = exported("warn", || { - let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) - .action(openshell_ocsf::ActionId::Denied) - .message("diagnostic text is not a policy reason") - .build(); - super::emit(finding, None, false); - let network = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + let http = openshell_ocsf::HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) .action(openshell_ocsf::ActionId::Denied) - .dst_endpoint(openshell_ocsf::Endpoint { - name: None, - domain: None, - ip: None, - port: None, - svc_name: None, + .http_request(openshell_ocsf::HttpRequest { + http_method: "GET".parse().unwrap(), + url: None, }) + .message("diagnostic text is not a policy reason") .build(); - super::emit(network, None, false); + super::emit(http, None); }) .await; assert_deny_resolves(&events, &received, true); - assert_eq!(events.len(), 2); - assert_eq!(received.spans.len(), 2); + assert_eq!(events.len(), 1); + assert_eq!(received.spans.len(), 1); for span in &received.spans { for key in [ "openshell.policy.name", @@ -330,6 +335,35 @@ async fn missing_deny_context_leaves_optional_attributes_unset() { } } +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn denials_without_an_http_record_do_not_open_deny_spans() { + let (events, received) = exported("warn", || { + let network = openshell_ocsf::NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain( + "blocked.example", + 443, + )) + .build(); + let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) + .build(); + super::emit_decision([network, finding], None, true); + tracing::info_span!("test.export-barrier").in_scope(|| {}); + }) + .await; + assert_eq!(events.len(), 2); + for event in events { + assert!(event.get("trace").is_none()); + } + assert!( + received + .spans + .iter() + .all(|span| span.name != "supervisor.egress.deny") + ); +} + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn allowed_emissions_do_not_create_info_deny_spans() { let (events, received) = exported("warn", || { @@ -340,7 +374,7 @@ async fn allowed_emissions_do_not_create_info_deny_spans() { 443, )) .build(); - super::emit(allowed, None, false); + super::emit(allowed, None); crate::l7::middleware::emit_middleware_uninspectable( &crate::l7::relay::L7EvalContext::default(), "unknown protocol", diff --git a/docs/observability/ocsf-json-export.mdx b/docs/observability/ocsf-json-export.mdx index bd8ebddffa..838dd38d1c 100644 --- a/docs/observability/ocsf-json-export.mdx +++ b/docs/observability/ocsf-json-export.mdx @@ -288,61 +288,18 @@ The JSON examples above are formatted for readability. The actual JSONL file con ## Follow a Deny Trace -Automatic correlation adds `trace.uid` to events emitted inside a valid, -sampled OpenTelemetry span and `trace` to `metadata.profiles`. The UID is a W3C trace ID -with 32 lowercase hexadecimal characters. Search for it in your configured -Jaeger or Tempo backend to inspect the supervisor's handling of the deny. -Without an active sampled context, automatic correlation adds neither the -trace object nor its profile, including when OTLP export is disabled. -A sampled ID does not guarantee -successful export or retention in the trace backend. - -Official OCSF 1.8.0 includes the Trace profile on -[HTTP Activity](https://github.com/ocsf/ocsf-schema/blob/v1.8.0/events/network/http_activity.json) -and [API Activity](https://github.com/ocsf/ocsf-schema/blob/v1.8.0/events/application/api_activity.json). -OpenShell extends its applicability to Network Activity, Detection Finding, -Authentication, Base Event, SSH Activity, Process Activity, Application Lifecycle, -and Device Config State Change. This optional profile on those eight classes is -an OpenShell extension beyond the official 1.8.0 class definitions. Consumers -that enforce official profile applicability may reject these correlated records -unless configured to accept the extension. - -Supervisor deny correlation requires a dedicated supervisor configured for OTLP -trace export. Shared supervisor hosts currently do not initialize OTLP exporters, -so their sandbox audit records have no automatic trace correlation. +HTTP Activity and API Activity records emitted inside a sampled OpenTelemetry span carry `trace.uid` and list `trace` in `metadata.profiles`. These are the classes OCSF 1.8.0 declares the Trace profile for. The UID is the W3C trace ID, 32 lowercase hexadecimal characters. Search for it in your Jaeger or Tempo backend. A sampled ID does not guarantee export or retention in the trace backend. ```json { - "metadata": { "profiles": ["security_control", "trace"] }, + "metadata": { "profiles": ["container", "host", "network_proxy", "security_control", "trace"] }, "trace": { "uid": "0af7651916cd43dd8448eb211c80319c" } } ``` -With OTLP export enabled, a network or HTTP deny creates an INFO -`supervisor.egress.deny` span around the audit records for that decision. -A domain event and its companion findings share one trace ID and one deny span. At the default supervisor -log level, the DEBUG connect span is disabled, so the trace contains only the -root deny span. It records the policy, reason and destination when available. -At debug level, a deny can share the connect trace and its authorization, -resolve and dial spans if those steps ran and the connect span remains -available. Allowed connections stay at DEBUG. Workload `traceparent` headers -do not supply supervisor correlation. - -Gateway audit records can inherit the caller's incoming `traceparent`, including -records emitted before authentication succeeds. Their trace IDs are correlation -hints, not evidence of the caller's identity or trust. An unsampled incoming -context can omit correlation. - -A deny span represents an enforced supervisor refusal, including fail-closed -middleware capacity refusals. When response middleware stops delivery, or the -proxy refuses to deliver a malformed upstream response head, it creates a deny -span. Ordinary upstream resets, downstream write failures, and response-body -framing errors do not create deny spans. Any delivery-failure findings describe -transport failure rather than an enforced refusal. -Allowed fail-open and audit-only traffic do not -create deny spans. Each refused decision can create an exported span, so repeated -refusals can increase telemetry volume; export and retention remain bounded by -your telemetry pipeline. +With OTLP trace export enabled on a dedicated supervisor, each denied HTTP request creates an INFO `supervisor.egress.deny` span around the audit records for that decision. The span records the policy, reason, and destination when available. At the default log level it is a root span. At debug level it joins the connect trace and its authorization, resolve, and dial spans when those ran. Shared supervisor hosts do not initialize OTLP exporters, so their records carry no trace correlation. Workload `traceparent` headers never supply supervisor correlation. + +Gateway API Activity records can inherit the caller's incoming `traceparent`, including before authentication succeeds. Treat their trace IDs as correlation hints, not evidence of the caller's identity. ## OCSF Event Classes in JSON From e44ea3010439401337276e416fd5941cb2eb2171 Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 09:33:05 -0800 Subject: [PATCH 04/12] refactor(supervisor-network): derive deny classification from the event Whether a decision opened a deny span came from three places: the event action, a denied: macro arm, and a flag passed to emit_decision. Several refusals were recorded only by those flags, so the audit records themselves did not say the request was refused. Mark the refusal in the records instead: fail-closed response middleware invocations, fail-closed and transformed-body policy failure findings, and enforced response delivery failures now carry action Denied. Deny classification reads only the records, and the flags are gone. Signed-off-by: Kris Hicks --- .../src/l7/middleware.rs | 35 +++++++- .../src/l7/relay.rs | 3 +- .../src/l7/rest.rs | 2 +- .../src/l7/rest/http_response.rs | 85 +++++++++++++++---- .../openshell-supervisor-network/src/proxy.rs | 3 +- .../src/telemetry.rs | 15 +--- .../src/telemetry/tests.rs | 2 +- 7 files changed, 109 insertions(+), 36 deletions(-) diff --git a/crates/openshell-supervisor-network/src/l7/middleware.rs b/crates/openshell-supervisor-network/src/l7/middleware.rs index 9fd6489029..539013db9f 100644 --- a/crates/openshell-supervisor-network/src/l7/middleware.rs +++ b/crates/openshell-supervisor-network/src/l7/middleware.rs @@ -963,6 +963,7 @@ pub(super) fn middleware_events( "openshell.middleware.failure", "Supervisor middleware failure", )) + .action(ActionId::Denied) .message("Required supervisor middleware failed closed") .build(); events.push(event); @@ -982,6 +983,7 @@ pub(super) fn middleware_events( ("policy", ctx.policy_name.as_str()), ("host", ctx.host.as_str()), ]) + .action(ActionId::Denied) .message("Transformed request denied because policy evaluation failed") .build(); events.push(event); @@ -1000,7 +1002,7 @@ fn emit_middleware_events( req: &crate::l7::provider::L7Request, outcome: &openshell_supervisor_middleware::ChainOutcome, ) { - crate::telemetry::emit_decision(middleware_events(ctx, req, outcome), None, !outcome.allowed); + crate::telemetry::emit_decision(middleware_events(ctx, req, outcome), None); } #[cfg(test)] @@ -1040,6 +1042,37 @@ mod trace_tests { } } + #[test] + fn refusal_findings_record_the_denial() { + for reason in [ + "middleware_failed: guard", + "transformed_body_policy_evaluation_failed: unavailable", + ] { + let outcome = openshell_supervisor_middleware::ChainOutcome { + allowed: false, + reason: reason.to_string(), + body: vec![], + header_mutations: vec![], + findings: vec![], + metadata: std::collections::BTreeMap::new(), + applied: vec![], + denial: None, + }; + let request = crate::l7::provider::L7Request { + action: "POST".to_string(), + target: "/".to_string(), + query_params: std::collections::HashMap::new(), + raw_header: vec![], + body_length: crate::l7::provider::BodyLength::None, + }; + let events = middleware_events(&L7EvalContext::default(), &request, &outcome); + assert_eq!(events.len(), 1, "{reason}"); + let finding = events[0].to_json().unwrap(); + assert_eq!(finding["class_uid"], 2004); + assert_eq!(finding["action_id"], 2, "{reason}"); + } + } + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn http_chain_outcomes_group_findings_and_preserve_allowed_controls() { for allowed in [true, false] { diff --git a/crates/openshell-supervisor-network/src/l7/relay.rs b/crates/openshell-supervisor-network/src/l7/relay.rs index 19d362752f..62b8e5a33b 100644 --- a/crates/openshell-supervisor-network/src/l7/relay.rs +++ b/crates/openshell-supervisor-network/src/l7/relay.rs @@ -293,7 +293,6 @@ where build_request_authority_mismatch_finding(ctx), ], None, - false, ); Ok(()) } @@ -653,7 +652,7 @@ where if endpoint_mismatch { events.push(build_credential_endpoint_mismatch_finding(ctx)); } - crate::telemetry::emit_decision(events, None, false); + crate::telemetry::emit_decision(events, None); Ok(()) } diff --git a/crates/openshell-supervisor-network/src/l7/rest.rs b/crates/openshell-supervisor-network/src/l7/rest.rs index 6c5980ed83..4e5cf7bbbd 100644 --- a/crates/openshell-supervisor-network/src/l7/rest.rs +++ b/crates/openshell-supervisor-network/src/l7/rest.rs @@ -1547,7 +1547,7 @@ fn emit_uninspected_body_credential_denial( ]) .message("Request body credential placeholder denied") .build(); - crate::telemetry::emit_decision([event, finding], None, false); + crate::telemetry::emit_decision([event, finding], None); } struct PreparedRequestBody { diff --git a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs index 2e20e9ee08..fdc749c2d3 100644 --- a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs +++ b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs @@ -423,10 +423,11 @@ where &middleware.target, status_code, false, + true, )); } } - crate::telemetry::emit_decision(preflight_events, None, !preflight.allowed); + crate::telemetry::emit_decision(preflight_events, None); if !preflight.allowed { if let Some(denial) = preflight.denial.as_ref() { send_response_middleware_denial( @@ -891,7 +892,6 @@ fn emit_http_response_middleware_invocations( crate::telemetry::emit_decision( http_response_decision_events(policy_name, target, status_code, invocations), None, - false, ); } @@ -914,9 +914,10 @@ fn emit_http_response_diagnostics( target, status_code, committed, + denied, )); } - crate::telemetry::emit_decision(events, None, denied); + crate::telemetry::emit_decision(events, None); } pub(super) fn http_response_middleware_invocation_events( @@ -930,8 +931,11 @@ pub(super) fn http_response_middleware_invocation_events( .map(|invocation| { let outcome = format!("{:?}", invocation.outcome).to_ascii_lowercase(); let failed = invocation.failed; - let blocked = invocation.outcome - == openshell_supervisor_middleware::HttpResponseInvocationOutcome::BlockDelivery; + let blocked = matches!( + invocation.outcome, + openshell_supervisor_middleware::HttpResponseInvocationOutcome::BlockDelivery + | openshell_supervisor_middleware::HttpResponseInvocationOutcome::FailClosed + ); openshell_ocsf::HttpActivityBuilder::new(ocsf_ctx()) .activity(openshell_ocsf::ActivityId::Other) .action(if blocked { @@ -1084,16 +1088,13 @@ fn emit_http_response_middleware_failure( status_code: u16, committed: bool, ) { - crate::telemetry::emit_decision( - [http_response_middleware_failure_event( - policy_name, - target, - status_code, - committed, - )], - None, + crate::telemetry::egress_emit!(http_response_middleware_failure_event( + policy_name, + target, + status_code, + committed, true, - ); + )); } fn http_response_middleware_failure_event( @@ -1101,9 +1102,14 @@ fn http_response_middleware_failure_event( target: &HttpRequestTarget, status_code: u16, committed: bool, + denied: bool, ) -> openshell_ocsf::OcsfEvent { let status_code = status_code.to_string(); - openshell_ocsf::DetectionFindingBuilder::new(ocsf_ctx()) + let mut builder = openshell_ocsf::DetectionFindingBuilder::new(ocsf_ctx()); + if denied { + builder = builder.action(openshell_ocsf::ActionId::Denied); + } + builder .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.middleware.http_response_failure", @@ -2221,7 +2227,11 @@ mod tests { invocations: vec![openshell_supervisor_middleware::HttpResponseInvocation { config_name: "content-guard".to_string(), implementation: "test/guard".to_string(), - outcome: HttpResponseInvocationOutcome::PassThrough, + outcome: if denied { + HttpResponseInvocationOutcome::BlockDelivery + } else { + HttpResponseInvocationOutcome::PassThrough + }, sequence: None, input_size: 0, output_size: None, @@ -2253,7 +2263,8 @@ mod tests { tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; - assert_eq!(events.len(), 2); + // A blocking invocation adds its own block finding. + assert_eq!(events.len(), if denied { 3 } else { 2 }); if denied { assert_deny_resolves(&events, &received, true); } else { @@ -2268,6 +2279,46 @@ mod tests { } } + #[test] + fn fail_closed_invocations_and_enforced_failures_record_the_denial() { + use openshell_supervisor_middleware::HttpResponseInvocationOutcome as Outcome; + + let target = super::HttpRequestTarget::default(); + for (outcome, failed, action_id) in [ + (Outcome::BlockDelivery, false, 2), + (Outcome::FailClosed, true, 2), + (Outcome::FailOpen, true, 99), + (Outcome::PassThrough, false, 1), + ] { + let invocation = openshell_supervisor_middleware::HttpResponseInvocation { + config_name: "guard".to_string(), + implementation: "test/guard".to_string(), + outcome, + sequence: None, + input_size: 0, + output_size: None, + failed, + stage_disabled: false, + reason_code: None, + failure_category: None, + }; + let events = + super::http_response_middleware_invocation_events("p", &target, 200, &[invocation]); + assert_eq!( + events[0].to_json().unwrap()["action_id"], + action_id, + "{outcome:?}" + ); + } + for denied in [false, true] { + let failure = + super::http_response_middleware_failure_event("p", &target, 200, false, denied) + .to_json() + .unwrap(); + assert_eq!(failure["action_id"] == 2, denied); + } + } + use super::{ ResponseFraming, parse_connection_keep_alive, parse_response_head_for_middleware, response_is_http_10, serialize_response_head, diff --git a/crates/openshell-supervisor-network/src/proxy.rs b/crates/openshell-supervisor-network/src/proxy.rs index 7b7660972b..6e3aca518a 100644 --- a/crates/openshell-supervisor-network/src/proxy.rs +++ b/crates/openshell-supervisor-network/src/proxy.rs @@ -255,7 +255,7 @@ fn emit_credential_endpoint_mismatch(method: &str, host: &str, port: u16, policy None, "Provider credential endpoint binding mismatch; request denied", ); - crate::telemetry::emit_decision([event, finding], None, false); + crate::telemetry::emit_decision([event, finding], None); } /// Hostnames injected by compute drivers as `/etc/hosts` aliases for the host @@ -2120,7 +2120,6 @@ fn emit_forward_l7_decision( crate::telemetry::emit_decision( std::iter::once(decision).chain(evaluation_error), Some(connect_span), - false, ); } diff --git a/crates/openshell-supervisor-network/src/telemetry.rs b/crates/openshell-supervisor-network/src/telemetry.rs index e353a46e6f..3447b0ef5d 100644 --- a/crates/openshell-supervisor-network/src/telemetry.rs +++ b/crates/openshell-supervisor-network/src/telemetry.rs @@ -33,23 +33,14 @@ fn is_http(event: &OcsfEvent) -> bool { } pub fn emit(event: OcsfEvent, parent: Option<&tracing::Span>) { - if !is_http(&event) || !is_denied(&event) { - openshell_ocsf::ocsf_emit!(event); - return; - } - let span = deny_span(&event, parent); - span.in_scope(|| openshell_ocsf::ocsf_emit!(event)); + emit_decision([event], parent); } /// Emit all records of one synchronous decision under one deny span. Different /// decisions remain separate, even when they concern the same connection. -pub fn emit_decision( - events: impl IntoIterator, - parent: Option<&tracing::Span>, - denied: bool, -) { +pub fn emit_decision(events: impl IntoIterator, parent: Option<&tracing::Span>) { let events: Vec<_> = events.into_iter().collect(); - let denied = denied || events.iter().any(is_denied); + let denied = events.iter().any(is_denied); let span = events .iter() .find(|event| denied && is_http(event)) diff --git a/crates/openshell-supervisor-network/src/telemetry/tests.rs b/crates/openshell-supervisor-network/src/telemetry/tests.rs index 29c124e4bb..0490369cc0 100644 --- a/crates/openshell-supervisor-network/src/telemetry/tests.rs +++ b/crates/openshell-supervisor-network/src/telemetry/tests.rs @@ -348,7 +348,7 @@ async fn denials_without_an_http_record_do_not_open_deny_spans() { let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .action(openshell_ocsf::ActionId::Denied) .build(); - super::emit_decision([network, finding], None, true); + super::emit_decision([network, finding], None); tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; From 8f4bf105d5e86a8faf34b17d0045c20aafd31653 Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 09:38:00 -0800 Subject: [PATCH 05/12] chore(supervisor-network): reject direct ocsf_emit! in the egress crate An HTTP deny emitted with openshell_ocsf::ocsf_emit! instead of egress_emit! silently gets no deny span, and the crate still used the upstream macro in several places. Disallow it in the crate clippy config and route every emission through egress_emit!. Signed-off-by: Kris Hicks --- AGENTS.md | 1 + crates/openshell-supervisor-network/clippy.toml | 6 ++++++ crates/openshell-supervisor-network/src/host.rs | 12 ++++++------ crates/openshell-supervisor-network/src/opa.rs | 4 ++-- .../src/policy_dns/runtime.rs | 6 +++--- .../src/policy_dns/store.rs | 2 +- .../openshell-supervisor-network/src/policy_local.rs | 8 ++++---- crates/openshell-supervisor-network/src/run.rs | 8 ++++---- crates/openshell-supervisor-network/src/telemetry.rs | 1 + 9 files changed, 28 insertions(+), 20 deletions(-) create mode 100644 crates/openshell-supervisor-network/clippy.toml diff --git a/AGENTS.md b/AGENTS.md index 2ba6597b9c..8866ead489 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -153,6 +153,7 @@ ocsf_emit!(event); - `crate::ocsf_ctx()` returns the process-wide `EventContext`. It is always available (falls back to defaults in tests). - `ocsf_emit!()` is non-blocking and cannot panic. It stores the event in a thread-local and emits via `tracing::info!()`. +- In `openshell-supervisor-network`, emit with `crate::telemetry::egress_emit!` instead, or `crate::telemetry::emit_decision` for the records of one decision, so denied HTTP decisions get a deny span. Clippy rejects `ocsf_emit!` there. - The shorthand layer and JSONL layer extract the event from the thread-local. The shorthand format is derived automatically from the builder fields. - For security findings, **dual-emit**: one domain event (e.g., `SshActivityBuilder`) AND one `DetectionFindingBuilder` for the same incident. - Never log secrets, credentials, or query parameters in OCSF messages. The OCSF JSONL file may be shipped to external systems. diff --git a/crates/openshell-supervisor-network/clippy.toml b/crates/openshell-supervisor-network/clippy.toml new file mode 100644 index 0000000000..0b7005afb4 --- /dev/null +++ b/crates/openshell-supervisor-network/clippy.toml @@ -0,0 +1,6 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +disallowed-macros = [ + { path = "openshell_ocsf::ocsf_emit", reason = "use crate::telemetry::egress_emit so denied HTTP decisions get a deny span" }, +] diff --git a/crates/openshell-supervisor-network/src/host.rs b/crates/openshell-supervisor-network/src/host.rs index b5ada8b100..d6fbe2e54f 100644 --- a/crates/openshell-supervisor-network/src/host.rs +++ b/crates/openshell-supervisor-network/src/host.rs @@ -23,7 +23,7 @@ use openshell_core::proto::SandboxPolicy as ProtoSandboxPolicy; use openshell_core::provider_credentials::ProviderCredentialState; use openshell_isolation_interface::contract::{BinaryIdentity, ExecutableIdentity, Sha256Digest}; use openshell_ocsf::{ - ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ctx::ctx as ocsf_ctx, ocsf_emit, + ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ctx::ctx as ocsf_ctx, }; use tokio::sync::mpsc::UnboundedSender; @@ -125,7 +125,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { let cert_cache = CertCache::new(ca); let state = Arc::new(ProxyTlsState::new(cert_cache, upstream_config)); - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -138,7 +138,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) @@ -152,7 +152,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) @@ -167,7 +167,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) @@ -181,7 +181,7 @@ pub async fn start_host_proxy(config: HostProxyConfig) -> Result { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) diff --git a/crates/openshell-supervisor-network/src/opa.rs b/crates/openshell-supervisor-network/src/opa.rs index 2d1a73a949..e6ec6ead5f 100644 --- a/crates/openshell-supervisor-network/src/opa.rs +++ b/crates/openshell-supervisor-network/src/opa.rs @@ -145,7 +145,7 @@ fn emit_binary_identity_mode(require_binary_identity: bool, source: &str) { require_binary_identity, source, "Configured OPA runtime binary identity mode" ); - openshell_ocsf::ocsf_emit!( + crate::telemetry::egress_emit!( openshell_ocsf::ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(openshell_ocsf::SeverityId::Informational) .status(openshell_ocsf::StatusId::Success) @@ -1427,7 +1427,7 @@ fn parse_process_policy(val: ®orus::Value) -> ProcessPolicy { fn emit_l7_config_warnings(warnings: &[String], prefix: &str) { for w in warnings { - openshell_ocsf::ocsf_emit!( + crate::telemetry::egress_emit!( openshell_ocsf::ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(openshell_ocsf::SeverityId::Medium) .status(openshell_ocsf::StatusId::Success) diff --git a/crates/openshell-supervisor-network/src/policy_dns/runtime.rs b/crates/openshell-supervisor-network/src/policy_dns/runtime.rs index cf1f61cfca..d7888f991e 100644 --- a/crates/openshell-supervisor-network/src/policy_dns/runtime.rs +++ b/crates/openshell-supervisor-network/src/policy_dns/runtime.rs @@ -14,7 +14,7 @@ use futures::{FutureExt as _, StreamExt as _, stream::FuturesUnordered}; use miette::{IntoDiagnostic, Result, WrapErr}; use openshell_core::net::set_tcp_nodelay_best_effort; use openshell_isolation_interface::contract::{DnsTransport, PendingDnsQuery}; -use openshell_ocsf::{ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ocsf_emit}; +use openshell_ocsf::{ConfigStateChangeBuilder, SeverityId, StateId, StatusId}; use openshell_sandbox_backend::NetworkMediationSource; use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr}; use std::sync::Arc; @@ -169,7 +169,7 @@ impl PolicyDnsRuntime { let _ = expiry_store.expire(std::time::Instant::now()); } }); - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -284,7 +284,7 @@ impl PolicyDnsRuntime { } }); - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) diff --git a/crates/openshell-supervisor-network/src/policy_dns/store.rs b/crates/openshell-supervisor-network/src/policy_dns/store.rs index 9c76e89c5e..62fe1c19bf 100644 --- a/crates/openshell-supervisor-network/src/policy_dns/store.rs +++ b/crates/openshell-supervisor-network/src/policy_dns/store.rs @@ -433,7 +433,7 @@ impl ResolvedEndpointStore { if allocated.saturating_mul(5) >= capacity.saturating_mul(4) && !emitted.swap(true, Ordering::Relaxed) { - openshell_ocsf::ocsf_emit!(build_pool_high_water_event( + crate::telemetry::egress_emit!(build_pool_high_water_event( allocated, capacity, family, )); } diff --git a/crates/openshell-supervisor-network/src/policy_local.rs b/crates/openshell-supervisor-network/src/policy_local.rs index 033f492aa7..bdf8898986 100644 --- a/crates/openshell-supervisor-network/src/policy_local.rs +++ b/crates/openshell-supervisor-network/src/policy_local.rs @@ -12,7 +12,7 @@ use openshell_core::proto::{ SandboxPolicy as ProtoSandboxPolicy, }; use openshell_ocsf::{ - ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ocsf_emit, sanitize_reason_for_audit, + ConfigStateChangeBuilder, SeverityId, StateId, StatusId, sanitize_reason_for_audit, }; use serde::Deserialize; use std::collections::HashMap; @@ -721,7 +721,7 @@ async fn submit_proposal(ctx: &PolicyLocalContext, body: &[u8]) -> (u16, serde_j /// and the endpoint the agent is asking to reach — what a developer needs /// to see in the audit trace to correlate against the inbox card. fn emit_policy_propose_event(chunk_id: &str, summary: &str) { - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -741,7 +741,7 @@ fn emit_policy_propose_event(chunk_id: &str, summary: &str) { fn emit_policy_decision_event(chunk: &PolicyChunk) { let summary = summarize_chunk_for_audit(chunk); match chunk.status.as_str() { - "approved" => ocsf_emit!( + "approved" => crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -763,7 +763,7 @@ fn emit_policy_decision_event(chunk: &PolicyChunk) { } else { format!("\"{sanitized}\"") }; - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Low) .status(StatusId::Success) diff --git a/crates/openshell-supervisor-network/src/run.rs b/crates/openshell-supervisor-network/src/run.rs index 9f8ce690f0..0c342c6bab 100644 --- a/crates/openshell-supervisor-network/src/run.rs +++ b/crates/openshell-supervisor-network/src/run.rs @@ -22,7 +22,7 @@ use openshell_core::policy::{NetworkMode, SandboxPolicy}; use openshell_core::proto::SandboxPolicy as ProtoSandboxPolicy; use openshell_core::provider_credentials::ProviderCredentialState; use openshell_ocsf::{ - ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ctx::ctx as ocsf_ctx, ocsf_emit, + ConfigStateChangeBuilder, SeverityId, StateId, StatusId, ctx::ctx as ocsf_ctx, }; use openshell_core::activity::ActivitySender; @@ -491,7 +491,7 @@ pub async fn run_networking( let upstream_config = build_upstream_client_config(&system_ca_bundle)?; let cert_cache = CertCache::new(ca); let state = Arc::new(ProxyTlsState::new(cert_cache, upstream_config)); - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::Informational) .status(StatusId::Success) @@ -510,7 +510,7 @@ pub async fn run_networking( // cannot rewrite credentials, so it fails closed on // TLS-bearing connections (see proxy.rs) rather than // leaking placeholders through a raw tunnel. - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) @@ -529,7 +529,7 @@ pub async fn run_networking( // rewrite credentials, so it fails closed on TLS-bearing // connections (see proxy.rs) rather than leaking placeholders // through a raw tunnel. - ocsf_emit!( + crate::telemetry::egress_emit!( ConfigStateChangeBuilder::new(ocsf_ctx()) .severity(SeverityId::High) .status(StatusId::Failure) diff --git a/crates/openshell-supervisor-network/src/telemetry.rs b/crates/openshell-supervisor-network/src/telemetry.rs index 3447b0ef5d..6d18e3a8ca 100644 --- a/crates/openshell-supervisor-network/src/telemetry.rs +++ b/crates/openshell-supervisor-network/src/telemetry.rs @@ -38,6 +38,7 @@ pub fn emit(event: OcsfEvent, parent: Option<&tracing::Span>) { /// Emit all records of one synchronous decision under one deny span. Different /// decisions remain separate, even when they concern the same connection. +#[allow(clippy::disallowed_macros)] pub fn emit_decision(events: impl IntoIterator, parent: Option<&tracing::Span>) { let events: Vec<_> = events.into_iter().collect(); let denied = events.iter().any(is_denied); From f85ae78cf0831e0b093f43b1efef53948cc5180e Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 09:41:57 -0800 Subject: [PATCH 06/12] feat(supervisor-network): rate-limit deny spans per destination Every denied HTTP decision exported a root span, and the workload controls how often it is denied. A tight retry loop against a blocked host could fill the batch exporter queue and push out the supervisor's other spans. Give each destination a token bucket of 10 deny spans that refills at one per second, tracking at most 1024 destinations. Denials past the limit still emit their OCSF records, without a trace. Signed-off-by: Kris Hicks --- .../src/telemetry.rs | 114 +++++++++++++++++- .../src/telemetry/tests.rs | 66 +++++++++- docs/observability/ocsf-json-export.mdx | 2 + 3 files changed, 175 insertions(+), 7 deletions(-) diff --git a/crates/openshell-supervisor-network/src/telemetry.rs b/crates/openshell-supervisor-network/src/telemetry.rs index 6d18e3a8ca..16e06427d7 100644 --- a/crates/openshell-supervisor-network/src/telemetry.rs +++ b/crates/openshell-supervisor-network/src/telemetry.rs @@ -3,6 +3,10 @@ //! Keep a deny span active during OCSF emission. +use std::collections::HashMap; +use std::sync::{LazyLock, Mutex}; +use std::time::{Duration, Instant}; + use openshell_ocsf::{ActionId, OcsfEvent}; /// Emit egress events, entering an INFO deny span for denied HTTP Activity. @@ -45,7 +49,7 @@ pub fn emit_decision(events: impl IntoIterator, parent: Option let span = events .iter() .find(|event| denied && is_http(event)) - .map(|event| deny_span(event, parent)); + .and_then(|event| deny_span(event, parent)); let emit = || { for event in events { openshell_ocsf::ocsf_emit!(event); @@ -59,14 +63,15 @@ pub fn emit_decision(events: impl IntoIterator, parent: Option } /// Build a decision scope, reusing an active deny scope for its companion -/// records rather than creating another exported span. -pub fn deny_span(event: &OcsfEvent, parent: Option<&tracing::Span>) -> tracing::Span { +/// records rather than creating another exported span. Returns `None` when the +/// destination has used up its deny spans. +pub fn deny_span(event: &OcsfEvent, parent: Option<&tracing::Span>) -> Option { let current = tracing::Span::current(); if current .metadata() .is_some_and(|metadata| metadata.name() == "supervisor.egress.deny") { - return current; + return Some(current); } let (endpoint, policy) = match event { OcsfEvent::HttpActivity(e) => (e.dst_endpoint.as_ref(), e.firewall_rule.as_ref()), @@ -76,6 +81,18 @@ pub fn deny_span(event: &OcsfEvent, parent: Option<&tracing::Span>) -> tracing:: let address = endpoint.and_then(|endpoint| endpoint.domain.as_deref().or(endpoint.ip.as_deref())); let port = endpoint.and_then(|endpoint| endpoint.port); + let destination = format!( + "{}:{}", + address.unwrap_or_default(), + port.unwrap_or_default() + ); + if !LIMITER + .lock() + .unwrap_or_else(std::sync::PoisonError::into_inner) + .allow(&destination, Instant::now()) + { + return None; + } let reason = event.base().status_detail.as_deref(); let parent = parent.cloned().unwrap_or_else(tracing::Span::current); let span = tracing::info_span!( @@ -100,7 +117,94 @@ pub fn deny_span(event: &OcsfEvent, parent: Option<&tracing::Span>) -> tracing:: if let Some(port) = port { span.record("server.port", i64::from(port)); } - span + Some(span) +} + +/// Deny spans one destination can export at once; one more is allowed per +/// second after that. +pub const DENY_SPAN_BURST: u32 = 10; +const DENY_SPAN_REFILL: Duration = Duration::from_secs(1); +const DENY_SPAN_DESTINATIONS: usize = 1024; + +static LIMITER: LazyLock> = LazyLock::new(|| { + Mutex::new(DenySpanLimiter::new( + DENY_SPAN_BURST, + DENY_SPAN_REFILL, + DENY_SPAN_DESTINATIONS, + )) +}); + +#[cfg(test)] +pub fn reset_deny_span_limiter() { + *LIMITER + .lock() + .unwrap_or_else(std::sync::PoisonError::into_inner) = + DenySpanLimiter::new(DENY_SPAN_BURST, DENY_SPAN_REFILL, DENY_SPAN_DESTINATIONS); +} + +/// Per-destination token bucket bounding how many deny spans one workload can +/// export. OCSF records are unaffected; a limited decision just has no span. +pub struct DenySpanLimiter { + burst: u32, + refill: Duration, + capacity: usize, + buckets: HashMap, +} + +struct Bucket { + tokens: u32, + refilled: Instant, +} + +impl DenySpanLimiter { + pub fn new(burst: u32, refill: Duration, capacity: usize) -> Self { + Self { + burst, + refill, + capacity, + buckets: HashMap::new(), + } + } + + pub fn allow(&mut self, destination: &str, now: Instant) -> bool { + if !self.buckets.contains_key(destination) && self.buckets.len() >= self.capacity { + for bucket in self.buckets.values_mut() { + bucket.refill(self.burst, self.refill, now); + } + let burst = self.burst; + self.buckets.retain(|_, bucket| bucket.tokens < burst); + if self.buckets.len() >= self.capacity { + return false; + } + } + let bucket = self + .buckets + .entry(destination.to_string()) + .or_insert(Bucket { + tokens: self.burst, + refilled: now, + }); + bucket.refill(self.burst, self.refill, now); + let allowed = bucket.tokens > 0; + bucket.tokens = bucket.tokens.saturating_sub(1); + allowed + } +} + +impl Bucket { + fn refill(&mut self, burst: u32, interval: Duration, now: Instant) { + let earned = now.saturating_duration_since(self.refilled).as_nanos() / interval.as_nanos(); + if earned == 0 { + return; + } + let earned = u32::try_from(earned).unwrap_or(u32::MAX); + self.tokens = self.tokens.saturating_add(earned).min(burst); + self.refilled = if self.tokens == burst { + now + } else { + self.refilled + interval * earned + }; + } } #[cfg(test)] diff --git a/crates/openshell-supervisor-network/src/telemetry/tests.rs b/crates/openshell-supervisor-network/src/telemetry/tests.rs index 0490369cc0..9e31defa6f 100644 --- a/crates/openshell-supervisor-network/src/telemetry/tests.rs +++ b/crates/openshell-supervisor-network/src/telemetry/tests.rs @@ -30,6 +30,7 @@ pub async fn exported( }); let _lock = tracing_test_lock().await; LazyLock::force(®ISTER); + super::reset_deny_span_limiter(); let collector = OtlpTestServer::start().await; let (provider, error) = openshell_otel::provider_for(Some(openshell_otel::OtlpExportConfig { endpoint: collector.endpoint(), @@ -164,7 +165,7 @@ async fn companion_emissions_reuse_an_active_decision_scope() { let event = http_deny("blocked.example", "denied"); let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()).build(); - let scope = super::deny_span(&event, None); + let scope = super::deny_span(&event, None).unwrap(); scope.in_scope(|| { super::emit(event, None); super::emit(finding, None); @@ -203,7 +204,7 @@ async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { ) .message(&decision) .build(); - let scope = super::deny_span(&event, None); + let scope = super::deny_span(&event, None).unwrap(); scope.in_scope(|| { super::emit(event, None); // Both threads keep different deny scopes entered @@ -395,3 +396,64 @@ async fn allowed_emissions_do_not_create_info_deny_spans() { .any(|span| span.name == "supervisor.egress.deny") ); } + +#[test] +fn deny_span_limiter_bounds_each_destination_and_refills() { + use std::time::{Duration, Instant}; + + let start = Instant::now(); + let mut limiter = super::DenySpanLimiter::new(2, Duration::from_secs(1), 8); + assert!(limiter.allow("a:443", start)); + assert!(limiter.allow("a:443", start)); + assert!(!limiter.allow("a:443", start)); + assert!( + limiter.allow("b:443", start), + "destinations are independent" + ); + assert!(!limiter.allow("a:443", start + Duration::from_millis(999))); + assert!(limiter.allow("a:443", start + Duration::from_secs(1))); + assert!(!limiter.allow("a:443", start + Duration::from_secs(1))); + let later = start + Duration::from_mins(1); + assert!(limiter.allow("a:443", later)); + assert!(limiter.allow("a:443", later)); + assert!(!limiter.allow("a:443", later), "refill stops at the burst"); +} + +#[test] +fn deny_span_limiter_bounds_tracked_destinations() { + use std::time::{Duration, Instant}; + + let start = Instant::now(); + let mut limiter = super::DenySpanLimiter::new(1, Duration::from_secs(1), 2); + assert!(limiter.allow("a", start)); + assert!(limiter.allow("b", start)); + assert!( + !limiter.allow("c", start), + "untracked destinations wait for room" + ); + // Full buckets are idle and can be evicted. + assert!(limiter.allow("c", start + Duration::from_secs(1))); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn repeated_denials_to_one_destination_export_bounded_spans() { + let (events, received) = exported("warn", || { + for _ in 0..(super::DENY_SPAN_BURST + 5) { + super::emit(http_deny("loop.example", "denied"), None); + } + super::emit(http_deny("other.example", "denied"), None); + }) + .await; + let denies = received + .spans + .iter() + .filter(|span| span.name == "supervisor.egress.deny") + .count(); + assert_eq!(denies, super::DENY_SPAN_BURST as usize + 1); + let traced = events + .iter() + .filter(|event| event.get("trace").is_some()) + .count(); + assert_eq!(traced, denies, "limited records carry no trace.uid"); + assert_eq!(events.len(), super::DENY_SPAN_BURST as usize + 6); +} diff --git a/docs/observability/ocsf-json-export.mdx b/docs/observability/ocsf-json-export.mdx index 838dd38d1c..e188a5b16b 100644 --- a/docs/observability/ocsf-json-export.mdx +++ b/docs/observability/ocsf-json-export.mdx @@ -299,6 +299,8 @@ HTTP Activity and API Activity records emitted inside a sampled OpenTelemetry sp With OTLP trace export enabled on a dedicated supervisor, each denied HTTP request creates an INFO `supervisor.egress.deny` span around the audit records for that decision. The span records the policy, reason, and destination when available. At the default log level it is a root span. At debug level it joins the connect trace and its authorization, resolve, and dial spans when those ran. Shared supervisor hosts do not initialize OTLP exporters, so their records carry no trace correlation. Workload `traceparent` headers never supply supervisor correlation. +To bound telemetry volume when a workload retries a blocked destination, the supervisor creates at most 10 deny spans per destination at once and one more per second after that. Records for denials past that limit omit `trace`. + Gateway API Activity records can inherit the caller's incoming `traceparent`, including before authentication succeeds. Treat their trace IDs as correlation hints, not evidence of the caller's identity. ## OCSF Event Classes in JSON From 2cb92bad0c70a7c37ec846386d1c6f138f30c3ff Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 09:44:06 -0800 Subject: [PATCH 07/12] feat(otel): set trace context on OCSF log records OCSF records exported over OTLP carried trace correlation only in the JSON body, and only for HTTP and API Activity. OTLP backends link logs to traces through the log record's own trace and span ID fields. Fill those fields from the sampled span active at emission. They are OTLP fields, not OCSF attributes, so every class gets them without affecting schema conformance; Network Activity and findings regain trace links on the OTLP path. Signed-off-by: Kris Hicks --- crates/openshell-otel/src/correlation.rs | 18 ++--- crates/openshell-otel/src/ocsf.rs | 72 +++++++++++++++++--- docs/how-it-works/gateways/configuration.mdx | 1 + docs/observability/ocsf-json-export.mdx | 2 + 4 files changed, 76 insertions(+), 17 deletions(-) diff --git a/crates/openshell-otel/src/correlation.rs b/crates/openshell-otel/src/correlation.rs index cb62a134fd..d451ef725b 100644 --- a/crates/openshell-otel/src/correlation.rs +++ b/crates/openshell-otel/src/correlation.rs @@ -3,8 +3,7 @@ //! Sampled trace correlation for OCSF producers. -use opentelemetry::trace::TraceContextExt as _; -use tracing_opentelemetry::OpenTelemetrySpanExt as _; +use opentelemetry::trace::{SpanContext, TraceContextExt as _}; /// Extract the active span's W3C trace ID for an OCSF event. /// @@ -15,11 +14,14 @@ use tracing_opentelemetry::OpenTelemetrySpanExt as _; /// origin. A sampled ID does not guarantee export or retention. #[must_use] pub fn current_ocsf_trace_correlation() -> Option { - let context = tracing::Span::current().context(); - let span = context.span(); - let span_context = span.span_context(); - if !span_context.is_sampled() { - return None; - } + let span_context = sampled_span_context()?; openshell_ocsf::TraceCorrelation::from_trace_id(span_context.trace_id().to_bytes()) } + +/// The OpenTelemetry tracing layer activates a span's context on entry, so this +/// also works inside a layer, where the tracing dispatcher is busy. +pub fn sampled_span_context() -> Option { + let context = opentelemetry::Context::current(); + let span_context = context.span().span_context().clone(); + (span_context.is_valid() && span_context.is_sampled()).then_some(span_context) +} diff --git a/crates/openshell-otel/src/ocsf.rs b/crates/openshell-otel/src/ocsf.rs index 3c0a0a1d64..63489fde1d 100644 --- a/crates/openshell-otel/src/ocsf.rs +++ b/crates/openshell-otel/src/ocsf.rs @@ -116,10 +116,11 @@ impl Layer for OcsfOtlpLayer { let Some(event) = clone_current_event() else { return; }; - let Ok(record) = log_record(&self.logger, &event, SystemTime::now()) else { + let Ok(mut record) = log_record(&self.logger, &event, SystemTime::now()) else { self.gap.record_loss("serialization", 1); return; }; + set_trace_context(&mut record); let bytes = record_bytes(&record); if bytes > BATCH_MAX_BYTES { self.gap.record_loss("oversized", 1); @@ -399,6 +400,18 @@ fn log_record( Ok(record) } +/// Link the record to the active sampled span through the OTLP record's own +/// trace fields, for every OCSF class. +fn set_trace_context(record: &mut SdkLogRecord) { + if let Some(span_context) = crate::correlation::sampled_span_context() { + record.set_trace_context( + span_context.trace_id(), + span_context.span_id(), + Some(span_context.trace_flags()), + ); + } +} + /// Map an OCSF severity onto an OTLP severity. /// /// OCSF ranks more levels than OTLP has bands. Low and Medium share the WARN @@ -418,7 +431,10 @@ fn severity(severity: SeverityId) -> Severity { #[cfg(test)] mod tests { use super::*; - use openshell_ocsf::{ConfigStateChangeBuilder, EventContext, EventOrigin, ocsf_emit}; + use openshell_ocsf::{ + ConfigStateChangeBuilder, EventContext, EventOrigin, HttpActivityBuilder, HttpRequest, Url, + ocsf_emit, + }; use opentelemetry::Key; use opentelemetry::logs::{AnyValue, Severity}; use opentelemetry_sdk::Resource; @@ -480,16 +496,21 @@ mod tests { } #[test] - fn trace_body_preserves_native_correlation_without_mutating_the_source() { - let mut correlated = - native(&ConfigStateChangeBuilder::new(&event_context("sandbox-1")).build()); + fn trace_body_preserves_native_correlation() { + let mut correlated = native( + &HttpActivityBuilder::new(&event_context("sandbox-1")) + .http_request(HttpRequest::new( + "GET", + Url::new("https", "example.com", "/", 443), + )) + .build(), + ); correlated["trace"] = serde_json::json!({"uid": "0af7651916cd43dd8448eb211c80319c"}); correlated["metadata"]["profiles"] .as_array_mut() .unwrap() .push("trace".into()); let event: OcsfEvent = serde_json::from_value(correlated).unwrap(); - let before = native(&event); let native_body = body(&record(&event)); assert_eq!(native_body, native(&event)); assert_eq!( @@ -503,13 +524,10 @@ mod tests { .iter() .any(|profile| profile == "trace") ); - assert_eq!( native_body["metadata"]["version"], openshell_ocsf::OCSF_VERSION ); - assert_eq!(native(&event), before); - assert_eq!(native(&event), native_body); } #[test] @@ -752,6 +770,42 @@ mod tests { assert_eq!(exporter.service_name().as_deref(), Some("openshell-test")); } + #[tokio::test] + async fn records_carry_the_sampled_span_context_for_every_class() { + use opentelemetry::trace::TraceContextExt as _; + use opentelemetry_sdk::trace::{InMemorySpanExporter, Sampler, SdkTracerProvider}; + use tracing_opentelemetry::OpenTelemetrySpanExt as _; + + for sampler in [Sampler::AlwaysOn, Sampler::AlwaysOff] { + let exporter = RecordingExporter::default(); + let otlp = OcsfOtlp::start(exporter.clone(), exporter_resource()); + let tracer = SdkTracerProvider::builder() + .with_sampler(sampler) + .with_simple_exporter(InMemorySpanExporter::default()) + .build(); + let subscriber = tracing_subscriber::registry() + .with(crate::layer(&tracer, "ocsf-test")) + .with(otlp.layer()); + let span_context = tracing::subscriber::with_default(subscriber, || { + let span = tracing::info_span!("decision"); + span.in_scope(|| ocsf_emit!(event("sandbox-1", SeverityId::Medium))); + span.context().span().span_context().clone() + }); + otlp.shutdown().await; + + let records = exporter.exported(); + let trace = records[0].record.trace_context(); + if span_context.is_sampled() { + let trace = trace.expect("sampled span context is attached"); + assert_eq!(trace.trace_id, span_context.trace_id()); + assert_eq!(trace.span_id, span_context.span_id()); + assert_eq!(trace.trace_flags, Some(span_context.trace_flags())); + } else { + assert!(trace.is_none()); + } + } + } + #[tokio::test] async fn shutdown_exports_every_queued_record_in_bounded_batches() { let exporter = RecordingExporter::default(); diff --git a/docs/how-it-works/gateways/configuration.mdx b/docs/how-it-works/gateways/configuration.mdx index 175836ccb4..424efa6016 100644 --- a/docs/how-it-works/gateways/configuration.mdx +++ b/docs/how-it-works/gateways/configuration.mdx @@ -810,6 +810,7 @@ Each OCSF event becomes one log record: | Timestamp | The OCSF `time`. The observed timestamp is when the gateway received the event. | | Severity | Unknown, Informational, and Other are INFO, Low is WARN, Medium is WARN2, High is ERROR, Critical is ERROR2, and Fatal is FATAL. The severity text is the OCSF severity name. | | Attributes | `ocsf.class_uid`, `ocsf.activity_id`, `ocsf.severity_id`, `ocsf.metadata.uid`, and, for events associated with a sandbox, `openshell.sandbox.id`. | +| Trace context | The trace and span ID of the sampled span active when the event was emitted, for every OCSF class. Absent when no sampled span was active. | `schema_version` in this table is deprecated and ignored; the gateway logs a warning at startup when it is set. diff --git a/docs/observability/ocsf-json-export.mdx b/docs/observability/ocsf-json-export.mdx index e188a5b16b..6808ccc0e3 100644 --- a/docs/observability/ocsf-json-export.mdx +++ b/docs/observability/ocsf-json-export.mdx @@ -290,6 +290,8 @@ The JSON examples above are formatted for readability. The actual JSONL file con HTTP Activity and API Activity records emitted inside a sampled OpenTelemetry span carry `trace.uid` and list `trace` in `metadata.profiles`. These are the classes OCSF 1.8.0 declares the Trace profile for. The UID is the W3C trace ID, 32 lowercase hexadecimal characters. Search for it in your Jaeger or Tempo backend. A sampled ID does not guarantee export or retention in the trace backend. +OTLP log export links every OCSF record, whatever its class, to the active sampled span through the log record's own trace and span ID fields. Use those fields for log-to-trace links in your backend. + ```json { "metadata": { "profiles": ["container", "host", "network_proxy", "security_control", "trace"] }, From 298b598b91f5e62ba2a56589c69c74b682d675fe Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 09:46:28 -0800 Subject: [PATCH 08/12] test(supervisor-network): use an in-memory span exporter for deny-span tests Each deny-span test started a loopback OTLP gRPC server and waited for a batch export, which made the suite slow. Capture spans with an in-memory exporter instead, converted to the same OTLP span shape, and keep two tests that export over OTLP end to end. Signed-off-by: Kris Hicks --- .../src/l7/relay.rs | 15 +++-- .../src/proxy/trace_tests.rs | 2 +- .../src/telemetry/tests.rs | 67 +++++++++++++++---- 3 files changed, 63 insertions(+), 21 deletions(-) diff --git a/crates/openshell-supervisor-network/src/l7/relay.rs b/crates/openshell-supervisor-network/src/l7/relay.rs index 62b8e5a33b..fa20252714 100644 --- a/crates/openshell-supervisor-network/src/l7/relay.rs +++ b/crates/openshell-supervisor-network/src/l7/relay.rs @@ -3804,11 +3804,14 @@ mod trace_tests { ..Default::default() }; let mut response = Vec::new(); - futures::executor::block_on(reject_request_authority_mismatch( - &mut response, - &ctx, - "POST", - )) + // The in-memory span processor exports with a futures executor. + tokio::task::block_in_place(|| { + tokio::runtime::Handle::current().block_on(reject_request_authority_mismatch( + &mut response, + &ctx, + "POST", + )) + }) .unwrap(); assert!(response.starts_with(b"HTTP/1.1 403 Forbidden")); }) @@ -3820,7 +3823,7 @@ mod trace_tests { #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn default_level_l7_relay_deny_uid_resolves_to_one_span_root_trace() { - let (events, received) = exported("warn", || { + let (events, received) = crate::telemetry::tests::exported_over_otlp("warn", || { let ctx = L7EvalContext { host: "blocked.example".to_string(), port: 443, diff --git a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs index 69bb66c23f..305869f86c 100644 --- a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs +++ b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs @@ -98,7 +98,7 @@ async fn network_class_forward_rejections_have_no_deny_trace() { #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn forward_denials_use_the_saved_connect_parent() { for level in ["warn", "debug"] { - let (events, received) = exported(level, || { + let (events, received) = crate::telemetry::tests::exported_over_otlp(level, || { let intent = EgressIntent::connect("blocked.example".to_string(), 443); let connect = egress::connect_span(&intent); let decision = EgressDecision { diff --git a/crates/openshell-supervisor-network/src/telemetry/tests.rs b/crates/openshell-supervisor-network/src/telemetry/tests.rs index 9e31defa6f..5cfa76ba37 100644 --- a/crates/openshell-supervisor-network/src/telemetry/tests.rs +++ b/crates/openshell-supervisor-network/src/telemetry/tests.rs @@ -18,16 +18,42 @@ impl std::io::Write for Writer { } } -/// Capture the actual OCSF dispatch and receive spans over OTLP/gRPC. +/// Capture the actual OCSF dispatch and the spans an in-memory exporter +/// receives through the supervisor's span filter. pub async fn exported( log_level: &str, emit: impl FnOnce(), ) -> (Vec, ReceivedTraces) { - static REGISTER: LazyLock<()> = LazyLock::new(|| { - assert!(openshell_ocsf::register_trace_correlation_extractor( - openshell_otel::current_ocsf_trace_correlation - )); - }); + let _lock = tracing_test_lock().await; + LazyLock::force(®ISTER); + super::reset_deny_span_limiter(); + let exporter = opentelemetry_sdk::trace::InMemorySpanExporter::default(); + let provider = opentelemetry_sdk::trace::SdkTracerProvider::builder() + .with_simple_exporter(exporter.clone()) + .build(); + let events = capture(log_level, &provider, emit); + provider.force_flush().unwrap(); + let spans = exporter + .get_finished_spans() + .unwrap() + .into_iter() + .map(Into::into) + .collect(); + provider.shutdown().unwrap(); + ( + events, + ReceivedTraces { + spans, + ..ReceivedTraces::default() + }, + ) +} + +/// Capture the actual OCSF dispatch and receive spans over OTLP/gRPC. +pub async fn exported_over_otlp( + log_level: &str, + emit: impl FnOnce(), +) -> (Vec, ReceivedTraces) { let _lock = tracing_test_lock().await; LazyLock::force(®ISTER); super::reset_deny_span_limiter(); @@ -40,6 +66,24 @@ pub async fn exported( })); assert!(error.is_none()); let provider = provider.unwrap(); + let events = capture(log_level, &provider, emit); + provider.force_flush().unwrap(); + collector.wait_for_export().await; + provider.shutdown().unwrap(); + (events, collector.shutdown().await) +} + +static REGISTER: LazyLock<()> = LazyLock::new(|| { + assert!(openshell_ocsf::register_trace_correlation_extractor( + openshell_otel::current_ocsf_trace_correlation + )); +}); + +fn capture( + log_level: &str, + provider: &opentelemetry_sdk::trace::SdkTracerProvider, + emit: impl FnOnce(), +) -> Vec { let bytes = Arc::new(Mutex::new(vec![])); let subscriber = tracing_subscriber::registry() .with( @@ -47,7 +91,7 @@ pub async fn exported( .with_filter(tracing_subscriber::filter::LevelFilter::INFO), ) .with( - openshell_otel::layer(&provider, "openshell-supervisor") + openshell_otel::layer(provider, "openshell-supervisor") .with_filter(openshell_otel::supervisor_span_filter(log_level)), ) // The shared test registry keeps callsites enabled process-wide. @@ -55,16 +99,11 @@ pub async fn exported( // DEBUG connect handle, as well as absence from the OTLP export. .with(openshell_otel::supervisor_span_filter(log_level)); tracing::subscriber::with_default(subscriber, emit); - provider.force_flush().unwrap(); - collector.wait_for_export().await; - provider.shutdown().unwrap(); - let received = collector.shutdown().await; - let events = String::from_utf8(bytes.lock().unwrap().clone()) + String::from_utf8(bytes.lock().unwrap().clone()) .unwrap() .lines() .map(|line| serde_json::from_str(line).unwrap()) - .collect(); - (events, received) + .collect() } pub fn assert_deny_resolves(events: &[serde_json::Value], received: &ReceivedTraces, root: bool) { From cfecb66d827f431fdab043ecc329bf18b51dbcd1 Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 09:48:51 -0800 Subject: [PATCH 09/12] docs(ocsf): describe which records report a refusal Several records that describe a refusal gained action Denied in this branch: FORWARD parse, canonicalization, GraphQL and JSON-RPC rejections, enforced L7 evaluation errors, metadata-server 403/405 responses, and fail-closed middleware and response delivery records. These shift deny counts in a SIEM, so list them where operators look for denied records. Signed-off-by: Kris Hicks --- docs/observability/ocsf-json-export.mdx | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/docs/observability/ocsf-json-export.mdx b/docs/observability/ocsf-json-export.mdx index 6808ccc0e3..af1c3927b0 100644 --- a/docs/observability/ocsf-json-export.mdx +++ b/docs/observability/ocsf-json-export.mdx @@ -286,12 +286,22 @@ And a denied connection, produced when `curl https://github.com` runs in a sandb The JSON examples above are formatted for readability. The actual JSONL file contains one JSON object per line with no whitespace formatting. +## Refusal Records + +Every record that describes a refusal sets `action` to `Denied`. On Network and HTTP Activity, `disposition` is `Blocked`, except for FORWARD requests with an unsupported scheme, which report `Rejected`. Besides policy denials, this includes: + +- FORWARD requests the proxy rejects as unparsable, non-canonical, or invalid GraphQL or JSON-RPC. +- L7 evaluation errors under `enforcement: enforce`. Under `enforcement: audit` they report `action` Other and `disposition` Allowed, because the request proceeds. +- Google Cloud metadata server emulation responses with status 403 or 405. +- Fail-closed request, response, and WebSocket middleware, including the HTTP Activity record for a fail-closed response stage and the Detection Findings for a fail-closed stage or chain or a failed post-middleware policy evaluation. +- Response delivery the supervisor refuses because middleware stopped it, its preflight failed, or the upstream response head could not be normalized for it. + +Count these records when you track denials, for example with `select(.action == "Denied")`. + ## Follow a Deny Trace HTTP Activity and API Activity records emitted inside a sampled OpenTelemetry span carry `trace.uid` and list `trace` in `metadata.profiles`. These are the classes OCSF 1.8.0 declares the Trace profile for. The UID is the W3C trace ID, 32 lowercase hexadecimal characters. Search for it in your Jaeger or Tempo backend. A sampled ID does not guarantee export or retention in the trace backend. -OTLP log export links every OCSF record, whatever its class, to the active sampled span through the log record's own trace and span ID fields. Use those fields for log-to-trace links in your backend. - ```json { "metadata": { "profiles": ["container", "host", "network_proxy", "security_control", "trace"] }, @@ -299,11 +309,13 @@ OTLP log export links every OCSF record, whatever its class, to the active sampl } ``` -With OTLP trace export enabled on a dedicated supervisor, each denied HTTP request creates an INFO `supervisor.egress.deny` span around the audit records for that decision. The span records the policy, reason, and destination when available. At the default log level it is a root span. At debug level it joins the connect trace and its authorization, resolve, and dial spans when those ran. Shared supervisor hosts do not initialize OTLP exporters, so their records carry no trace correlation. Workload `traceparent` headers never supply supervisor correlation. +OTLP log export links every OCSF record, whatever its class, to the active sampled span through the log record's own trace and span ID fields. Use those fields for log-to-trace links in your backend. + +With OTLP trace export enabled on a dedicated supervisor, each denied HTTP request creates an INFO `supervisor.egress.deny` span around the audit records for that decision. The span records the policy, reason, and destination when available. At the default log level, every deny span is a root span. At debug level, FORWARD proxy denials made before the request is relayed, including request middleware denials, join the connect trace and its authorization, resolve, and dial spans. Other deny spans, including L7 denials inside CONNECT tunnels and response middleware denials, remain root spans. Shared supervisor hosts do not initialize OTLP exporters, so their records carry no trace correlation. Workload `traceparent` headers never supply supervisor correlation. To bound telemetry volume when a workload retries a blocked destination, the supervisor creates at most 10 deny spans per destination at once and one more per second after that. Records for denials past that limit omit `trace`. -Gateway API Activity records can inherit the caller's incoming `traceparent`, including before authentication succeeds. Treat their trace IDs as correlation hints, not evidence of the caller's identity. +Gateway records and their OTLP trace context can inherit the caller's incoming `traceparent`, including before authentication succeeds. The caller also decides whether they are correlated at all, because an unsampled `traceparent` suppresses `trace.uid`. Treat gateway trace IDs as correlation hints, not evidence of the caller's identity, and do not treat a missing `trace.uid` as meaningful. ## OCSF Event Classes in JSON From 8626d5153595098cf3ccbc822b320c284d11ed89 Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 10:23:24 -0800 Subject: [PATCH 10/12] refactor(supervisor-network): reduce deny spans to one entry point The deny-span API still carried paths for nested and non-HTTP deny scopes that no caller reaches now that only HTTP decisions get spans, and a decision whose first HTTP record was allowed opened its deny span with that record's destination and no reason. emit_decision is now the single entry point, behind a one-arm egress_emit!. It anchors the span on the denied HTTP record and sets optional attributes directly. Records that never share a span are emitted inline again, response diagnostics return their events so each error path adds its own terminal failure, and the trace tests share deny-span helpers and fixtures. Signed-off-by: Kris Hicks --- .../src/l7/middleware.rs | 127 ++++---- .../src/l7/mod.rs | 11 +- .../src/l7/rest.rs | 38 +-- .../src/l7/rest/http_response.rs | 308 ++++++++---------- .../src/l7/websocket.rs | 37 +-- .../openshell-supervisor-network/src/proxy.rs | 72 ++-- .../src/proxy/trace_tests.rs | 59 +--- .../src/telemetry.rs | 116 +++---- .../src/telemetry/tests.rs | 152 ++++----- 9 files changed, 382 insertions(+), 538 deletions(-) diff --git a/crates/openshell-supervisor-network/src/l7/middleware.rs b/crates/openshell-supervisor-network/src/l7/middleware.rs index 539013db9f..495d02d1ad 100644 --- a/crates/openshell-supervisor-network/src/l7/middleware.rs +++ b/crates/openshell-supervisor-network/src/l7/middleware.rs @@ -1008,10 +1008,11 @@ fn emit_middleware_events( #[cfg(test)] mod trace_tests { use super::*; - use crate::telemetry::tests::{assert_deny_resolves, exported}; + use crate::telemetry::tests::{assert_deny_resolves, assert_no_deny, deny_spans, exported}; + use openshell_supervisor_middleware::{ChainOutcome, MiddlewareInvocation, NamespacedFinding}; - fn finding() -> openshell_supervisor_middleware::NamespacedFinding { - openshell_supervisor_middleware::NamespacedFinding { + fn finding() -> NamespacedFinding { + NamespacedFinding { middleware: "guard".to_string(), finding: openshell_core::proto::Finding { r#type: "test.finding".to_string(), @@ -1023,22 +1024,31 @@ mod trace_tests { } } - fn assert_decision( - events: &[serde_json::Value], - received: &openshell_otel_test_support::ReceivedTraces, - denied: bool, - ) { - assert!(!events.is_empty()); - let deny_count = received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .count(); - assert_eq!(deny_count, usize::from(denied)); - if denied { - assert_deny_resolves(events, received, true); - } else { - assert!(events.iter().all(|event| event.get("trace").is_none())); + fn outcome( + allowed: bool, + reason: &str, + applied: Vec, + findings: Vec, + ) -> ChainOutcome { + ChainOutcome { + allowed, + reason: reason.to_string(), + body: vec![], + header_mutations: vec![], + findings, + metadata: std::collections::BTreeMap::new(), + applied, + denial: None, + } + } + + fn request() -> crate::l7::provider::L7Request { + crate::l7::provider::L7Request { + action: "POST".to_string(), + target: "/".to_string(), + query_params: std::collections::HashMap::new(), + raw_header: vec![], + body_length: crate::l7::provider::BodyLength::None, } } @@ -1048,24 +1058,11 @@ mod trace_tests { "middleware_failed: guard", "transformed_body_policy_evaluation_failed: unavailable", ] { - let outcome = openshell_supervisor_middleware::ChainOutcome { - allowed: false, - reason: reason.to_string(), - body: vec![], - header_mutations: vec![], - findings: vec![], - metadata: std::collections::BTreeMap::new(), - applied: vec![], - denial: None, - }; - let request = crate::l7::provider::L7Request { - action: "POST".to_string(), - target: "/".to_string(), - query_params: std::collections::HashMap::new(), - raw_header: vec![], - body_length: crate::l7::provider::BodyLength::None, - }; - let events = middleware_events(&L7EvalContext::default(), &request, &outcome); + let events = middleware_events( + &L7EvalContext::default(), + &request(), + &outcome(false, reason, vec![], vec![]), + ); assert_eq!(events.len(), 1, "{reason}"); let finding = events[0].to_json().unwrap(); assert_eq!(finding["class_uid"], 2004); @@ -1077,44 +1074,36 @@ mod trace_tests { async fn http_chain_outcomes_group_findings_and_preserve_allowed_controls() { for allowed in [true, false] { let (events, received) = exported("warn", || { - let outcome = openshell_supervisor_middleware::ChainOutcome { - allowed, - reason: if allowed { - "allowed" + let invocation = MiddlewareInvocation { + name: "guard".to_string(), + implementation: "test/guard".to_string(), + decision: if allowed { + openshell_core::proto::Decision::Allow } else { - "middleware_failed: guard" - } - .to_string(), - body: vec![], - header_mutations: vec![], - findings: vec![finding()], - metadata: std::collections::BTreeMap::new(), - applied: vec![openshell_supervisor_middleware::MiddlewareInvocation { - name: "guard".to_string(), - implementation: "test/guard".to_string(), - decision: if allowed { - openshell_core::proto::Decision::Allow - } else { - openshell_core::proto::Decision::Deny - }, - transformed: false, - failed: false, - }], - denial: None, + openshell_core::proto::Decision::Deny + }, + transformed: false, + failed: false, }; - let request = crate::l7::provider::L7Request { - action: "POST".to_string(), - target: "/".to_string(), - query_params: std::collections::HashMap::new(), - raw_header: vec![], - body_length: crate::l7::provider::BodyLength::None, + let reason = if allowed { + "allowed" + } else { + "middleware_failed: guard" }; - emit_middleware_events(&L7EvalContext::default(), &request, &outcome); - tracing::info_span!("test.export-barrier").in_scope(|| {}); + emit_middleware_events( + &L7EvalContext::default(), + &request(), + &outcome(allowed, reason, vec![invocation], vec![finding()]), + ); }) .await; assert!(events.len() >= 2); - assert_decision(&events, &received, !allowed); + if allowed { + assert_no_deny(&events, &received); + } else { + assert_eq!(deny_spans(&received).len(), 1); + assert_deny_resolves(&events, &received, true); + } } } } diff --git a/crates/openshell-supervisor-network/src/l7/mod.rs b/crates/openshell-supervisor-network/src/l7/mod.rs index cd6673f861..43efece737 100644 --- a/crates/openshell-supervisor-network/src/l7/mod.rs +++ b/crates/openshell-supervisor-network/src/l7/mod.rs @@ -460,12 +460,8 @@ pub fn parse_l7_config(val: ®orus::Value) -> Option { }) } -pub(crate) fn build_uninspected_credential_finding( - host: &str, - policy_name: &str, - surface: &str, -) -> openshell_ocsf::OcsfEvent { - openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) +pub(crate) fn emit_uninspected_credential_finding(host: &str, policy_name: &str, surface: &str) { + let event = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.credentials.traffic_uninspectable", @@ -478,7 +474,8 @@ pub(crate) fn build_uninspected_credential_finding( ("disposition", "denied"), ]) .message("Uninspected credential-bearing traffic denied") - .build() + .build(); + crate::telemetry::egress_emit!(event); } impl L7EndpointConfig { diff --git a/crates/openshell-supervisor-network/src/l7/rest.rs b/crates/openshell-supervisor-network/src/l7/rest.rs index 4e5cf7bbbd..f59374eea1 100644 --- a/crates/openshell-supervisor-network/src/l7/rest.rs +++ b/crates/openshell-supervisor-network/src/l7/rest.rs @@ -1534,6 +1534,7 @@ fn emit_uninspected_body_credential_denial( req.action, options.host, options.port )) .build(); + crate::telemetry::egress_emit!(event); let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( @@ -1547,7 +1548,7 @@ fn emit_uninspected_body_credential_denial( ]) .message("Request body credential placeholder denied") .build(); - crate::telemetry::emit_decision([event, finding], None); + crate::telemetry::egress_emit!(finding); } struct PreparedRequestBody { @@ -6917,7 +6918,7 @@ mod tests { #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn response_trace_failure_records_share_the_terminal_decision() { - use crate::telemetry::tests::{assert_deny_resolves, exported}; + use crate::telemetry::tests::{assert_deny_resolves, deny_spans, exported}; // This relay fixture has no CONNECT span, so denies are roots at both // levels. The thread-local export harness observes the relay task; @@ -6966,11 +6967,7 @@ mod tests { .collect(); assert!(companions.len() >= 2, "failure includes diagnostic records"); assert_eq!( - received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .count(), + deny_spans(&received).len(), 1, "one response stop is one exported decision" ); @@ -7025,18 +7022,11 @@ mod tests { } }); }); - tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; assert!(events.iter().any(|event| event["finding_info"]["uid"] == "openshell.middleware.http_response_failure")); - assert!(events.iter().all(|event| event.get("trace").is_none())); - assert!( - !received - .spans - .iter() - .any(|span| span.name == "supervisor.egress.deny") - ); + crate::telemetry::tests::assert_no_deny(&events, &received); } } @@ -7093,20 +7083,13 @@ mod tests { assert!(!String::from_utf8_lossy(&delivered.0).contains("502 Bad Gateway")); }); }); - tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; assert!( events.iter().any(|event| event["finding_info"]["uid"] == "openshell.middleware.http_response_failure") ); - assert!(events.iter().all(|event| event.get("trace").is_none())); - assert!( - !received - .spans - .iter() - .any(|span| span.name == "supervisor.egress.deny") - ); + crate::telemetry::tests::assert_no_deny(&events, &received); } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] @@ -7129,17 +7112,10 @@ mod tests { }); assert!(outcome.is_ok()); assert!(delivered.starts_with(b"HTTP/1.1 200 OK\r\n")); - tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; assert!(!events.is_empty()); - assert!(events.iter().all(|event| event.get("trace").is_none())); - assert!( - !received - .spans - .iter() - .any(|span| span.name == "supervisor.egress.deny") - ); + crate::telemetry::tests::assert_no_deny(&events, &received); } } diff --git a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs index fdc749c2d3..a8e080b8ac 100644 --- a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs +++ b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs @@ -449,11 +449,14 @@ where } return Ok(Some(RelayOutcome::Consumed)); } - emit_http_response_middleware_invocations( - middleware.policy_name, - &middleware.target, - status_code, - &preflight.invocations, + crate::telemetry::emit_decision( + http_response_decision_events( + middleware.policy_name, + &middleware.target, + status_code, + &preflight.invocations, + ), + None, ); let Some(mut session) = preflight.session else { @@ -487,14 +490,21 @@ where Ok(finish) => finish, Err(error) => { debug!(error = %error, "HTTP response middleware finalization failed"); - emit_http_response_diagnostics( + let mut events = http_response_diagnostic_events( middleware.policy_name, &middleware.target, status_code, - &error.diagnostics, - true, - Some(false), + &error.diagnostics.invocations, + &error.diagnostics.findings, ); + events.push(http_response_middleware_failure_event( + middleware.policy_name, + &middleware.target, + status_code, + false, + true, + )); + crate::telemetry::emit_decision(events, None); send_response_delivery_failure( client, request_method, @@ -509,15 +519,16 @@ where guard.ensure_current()?; } let mut headers = preflight.headers; - emit_http_response_middleware_invocations( - middleware.policy_name, - &middleware.target, - status_code, - &finish.invocations, + crate::telemetry::emit_decision( + http_response_diagnostic_events( + middleware.policy_name, + &middleware.target, + status_code, + &finish.invocations, + &finish.findings, + ), + None, ); - for event in crate::l7::middleware::middleware_finding_events(&finish.findings) { - crate::telemetry::egress_emit!(event); - } if finish.strip_stale_integrity_headers { strip_response_integrity_headers(&mut headers); } @@ -620,17 +631,26 @@ where // Diagnostics from a middleware stop and its terminal finding are // one decision. Transport/framing errors still record delivery // failure, but do not imply an enforced middleware refusal. - let empty_diagnostics = - openshell_supervisor_middleware::HttpResponseDiagnostics::default(); - emit_http_response_diagnostics( - middleware.policy_name, - &middleware.target, - status_code, - middleware_stop.map_or(&empty_diagnostics, |stop| &stop.diagnostics), - middleware_stop.is_some(), - (committed || middleware_stop.is_none_or(|stop| stop.failure.denial.is_none())) - .then_some(committed), - ); + let mut events = middleware_stop.map_or_else(Vec::new, |stop| { + http_response_diagnostic_events( + middleware.policy_name, + &middleware.target, + status_code, + &stop.diagnostics.invocations, + &stop.diagnostics.findings, + ) + }); + // A denial sent before commitment is reported by its invocation. + if committed || middleware_stop.is_none_or(|stop| stop.failure.denial.is_none()) { + events.push(http_response_middleware_failure_event( + middleware.policy_name, + &middleware.target, + status_code, + committed, + middleware_stop.is_some(), + )); + } + crate::telemetry::emit_decision(events, None); if committed { return Err(error); } @@ -669,14 +689,23 @@ where let finish = match session.finish(trailers).await { Ok(finish) => finish, Err(error) => { - emit_http_response_diagnostics( + let mut events = http_response_diagnostic_events( middleware.policy_name, &middleware.target, status_code, - &error.diagnostics, - true, - (committed || error.denial.is_none()).then_some(committed), + &error.diagnostics.invocations, + &error.diagnostics.findings, ); + if committed || error.denial.is_none() { + events.push(http_response_middleware_failure_event( + middleware.policy_name, + &middleware.target, + status_code, + committed, + true, + )); + } + crate::telemetry::emit_decision(events, None); if committed { return Err(miette!( "HTTP response middleware failed after commitment: {error}" @@ -707,15 +736,16 @@ where if let Some(guard) = middleware.generation_guard { guard.ensure_current()?; } - emit_http_response_middleware_invocations( - middleware.policy_name, - &middleware.target, - status_code, - &finish.invocations, + crate::telemetry::emit_decision( + http_response_diagnostic_events( + middleware.policy_name, + &middleware.target, + status_code, + &finish.invocations, + &finish.findings, + ), + None, ); - for event in crate::l7::middleware::middleware_finding_events(&finish.findings) { - crate::telemetry::egress_emit!(event); - } if whole_body && !committed { let mut headers = preflight.headers; @@ -883,16 +913,16 @@ fn http_response_decision_events( events } -fn emit_http_response_middleware_invocations( +fn http_response_diagnostic_events( policy_name: &str, target: &HttpRequestTarget, status_code: u16, invocations: &[openshell_supervisor_middleware::HttpResponseInvocation], -) { - crate::telemetry::emit_decision( - http_response_decision_events(policy_name, target, status_code, invocations), - None, - ); + findings: &[openshell_supervisor_middleware::NamespacedFinding], +) -> Vec { + let mut events = http_response_decision_events(policy_name, target, status_code, invocations); + events.extend(crate::l7::middleware::middleware_finding_events(findings)); + events } fn emit_http_response_diagnostics( @@ -900,24 +930,17 @@ fn emit_http_response_diagnostics( target: &HttpRequestTarget, status_code: u16, diagnostics: &openshell_supervisor_middleware::HttpResponseDiagnostics, - denied: bool, - terminal_failure: Option, ) { - let mut events = - http_response_decision_events(policy_name, target, status_code, &diagnostics.invocations); - events.extend(crate::l7::middleware::middleware_finding_events( - &diagnostics.findings, - )); - if let Some(committed) = terminal_failure { - events.push(http_response_middleware_failure_event( + crate::telemetry::emit_decision( + http_response_diagnostic_events( policy_name, target, status_code, - committed, - denied, - )); - } - crate::telemetry::emit_decision(events, None); + &diagnostics.invocations, + &diagnostics.findings, + ), + None, + ); } pub(super) fn http_response_middleware_invocation_events( @@ -1728,8 +1751,6 @@ async fn expire_whole_body_deadline( framing.target, framing.status_code, &diagnostics, - false, - None, ); } let output = output.map_err(|failure| ResponseMiddlewareStop::new(failure, diagnostics))?; @@ -1874,8 +1895,6 @@ async fn process_response_unit( framing.target, framing.status_code, &diagnostics, - false, - None, ); } let output = output.map_err(|failure| ResponseMiddlewareStop::new(failure, diagnostics))?; @@ -2135,69 +2154,52 @@ pub(super) fn response_is_event_stream(headers: &str) -> bool { #[cfg(test)] mod tests { - #[tokio::test(flavor = "multi_thread", worker_threads = 2)] - async fn response_denial_and_companion_findings_share_one_trace() { - use crate::telemetry::tests::{assert_deny_resolves, exported}; - use openshell_supervisor_middleware::HttpResponseInvocationOutcome; - - let (events, received) = exported("warn", || { - let diagnostics = openshell_supervisor_middleware::HttpResponseDiagnostics { - invocations: vec![openshell_supervisor_middleware::HttpResponseInvocation { - config_name: "guard".to_string(), - implementation: "test/guard".to_string(), - outcome: HttpResponseInvocationOutcome::BlockDelivery, - sequence: None, - input_size: 0, - output_size: None, - failed: false, - stage_disabled: false, - reason_code: None, - failure_category: None, - }], - findings: vec![openshell_supervisor_middleware::NamespacedFinding { - middleware: "guard".to_string(), - finding: openshell_core::proto::Finding { - r#type: "test.finding".to_string(), - label: "Test finding".to_string(), - count: 1, - severity: "high".to_string(), - ..Default::default() - }, - }], + use openshell_supervisor_middleware::{ + HttpResponseInvocation, HttpResponseInvocationOutcome as Outcome, NamespacedFinding, + }; + + fn invocation(outcome: Outcome, failed: bool) -> HttpResponseInvocation { + HttpResponseInvocation { + config_name: "guard".to_string(), + implementation: "test/guard".to_string(), + outcome, + sequence: None, + input_size: 0, + output_size: None, + failed, + stage_disabled: false, + reason_code: None, + failure_category: None, + } + } + + fn finding() -> NamespacedFinding { + NamespacedFinding { + middleware: "guard".to_string(), + finding: openshell_core::proto::Finding { + r#type: "test.finding".to_string(), + label: "Test finding".to_string(), + count: 1, + severity: "high".to_string(), ..Default::default() - }; - super::emit_http_response_diagnostics( - "response-policy", - &super::HttpRequestTarget::default(), - 200, - &diagnostics, - true, - None, - ); - }) - .await; - assert!(events.len() >= 2); - assert_eq!(received.spans.len(), 1); - assert_deny_resolves(&events, &received, true); + }, + } } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn response_terminal_failure_without_diagnostics_has_no_deny_trace() { - use crate::telemetry::tests::exported; + use crate::telemetry::tests::{assert_no_deny, exported}; // Platform refusals can lack invocation diagnostics, but must retain // their terminal failure record. Without an HTTP record, no deny span. for committed in [false, true] { let (events, received) = exported("warn", || { - super::emit_http_response_diagnostics( + super::emit_http_response_middleware_failure( "response-policy", &super::HttpRequestTarget::default(), 200, - &openshell_supervisor_middleware::HttpResponseDiagnostics::default(), - true, - Some(committed), + committed, ); - tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; @@ -2206,50 +2208,24 @@ mod tests { events[0]["finding_info"]["uid"], "openshell.middleware.http_response_failure" ); - assert!(events[0].get("trace").is_none()); - assert!( - received - .spans - .iter() - .all(|span| span.name != "supervisor.egress.deny") - ); + assert_no_deny(&events, &received); } } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] - async fn response_diagnostic_findings_create_deny_spans_only_when_delivery_is_denied() { - use crate::telemetry::tests::{assert_deny_resolves, exported}; - use openshell_supervisor_middleware::HttpResponseInvocationOutcome; + async fn response_diagnostic_findings_share_a_deny_span_only_when_delivery_is_denied() { + use crate::telemetry::tests::{assert_deny_resolves, assert_no_deny, exported}; for denied in [false, true] { let (events, received) = exported("warn", || { + let outcome = if denied { + Outcome::BlockDelivery + } else { + Outcome::PassThrough + }; let diagnostics = openshell_supervisor_middleware::HttpResponseDiagnostics { - invocations: vec![openshell_supervisor_middleware::HttpResponseInvocation { - config_name: "content-guard".to_string(), - implementation: "test/guard".to_string(), - outcome: if denied { - HttpResponseInvocationOutcome::BlockDelivery - } else { - HttpResponseInvocationOutcome::PassThrough - }, - sequence: None, - input_size: 0, - output_size: None, - failed: false, - stage_disabled: false, - reason_code: None, - failure_category: None, - }], - findings: vec![openshell_supervisor_middleware::NamespacedFinding { - middleware: "content-guard".into(), - finding: openshell_core::proto::Finding { - r#type: "test.finding".into(), - label: "Test finding".into(), - count: 1, - severity: "high".into(), - ..Default::default() - }, - }], + invocations: vec![invocation(outcome, false)], + findings: vec![finding()], ..Default::default() }; super::emit_http_response_diagnostics( @@ -2257,32 +2233,22 @@ mod tests { &super::HttpRequestTarget::default(), 200, &diagnostics, - denied, - None, ); - tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; // A blocking invocation adds its own block finding. assert_eq!(events.len(), if denied { 3 } else { 2 }); if denied { + assert_eq!(received.spans.len(), 1); assert_deny_resolves(&events, &received, true); } else { - assert!(events.iter().all(|event| event.get("trace").is_none())); - assert!( - !received - .spans - .iter() - .any(|span| span.name == "supervisor.egress.deny") - ); + assert_no_deny(&events, &received); } } } #[test] fn fail_closed_invocations_and_enforced_failures_record_the_denial() { - use openshell_supervisor_middleware::HttpResponseInvocationOutcome as Outcome; - let target = super::HttpRequestTarget::default(); for (outcome, failed, action_id) in [ (Outcome::BlockDelivery, false, 2), @@ -2290,20 +2256,12 @@ mod tests { (Outcome::FailOpen, true, 99), (Outcome::PassThrough, false, 1), ] { - let invocation = openshell_supervisor_middleware::HttpResponseInvocation { - config_name: "guard".to_string(), - implementation: "test/guard".to_string(), - outcome, - sequence: None, - input_size: 0, - output_size: None, - failed, - stage_disabled: false, - reason_code: None, - failure_category: None, - }; - let events = - super::http_response_middleware_invocation_events("p", &target, 200, &[invocation]); + let events = super::http_response_middleware_invocation_events( + "p", + &target, + 200, + &[invocation(outcome, failed)], + ); assert_eq!( events[0].to_json().unwrap()["action_id"], action_id, diff --git a/crates/openshell-supervisor-network/src/l7/websocket.rs b/crates/openshell-supervisor-network/src/l7/websocket.rs index 52c19dcb1d..4d688929c6 100644 --- a/crates/openshell-supervisor-network/src/l7/websocket.rs +++ b/crates/openshell-supervisor-network/src/l7/websocket.rs @@ -641,27 +641,27 @@ async fn write_policy_violation_close(writer: &mut W) -> } fn emit_credential_endpoint_mismatch(host: &str, port: u16, policy_name: &str) { - let event = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) - .activity(ActivityId::Fail) - .action(ActionId::Denied) - .disposition(DispositionId::Blocked) - .severity(SeverityId::High) - .status(StatusId::Failure) - .dst_endpoint(Endpoint::from_domain(host, port)) - .firewall_rule(policy_name, "credential-binding") - .message(format!( - "WebSocket credential use denied: credential is not authorized for {host}:{port}" - )) - .status_detail("credential_endpoint_mismatch") - .build(); - let finding = crate::l7::build_credential_endpoint_mismatch_finding( + egress_emit!( + NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .activity(ActivityId::Fail) + .action(ActionId::Denied) + .disposition(DispositionId::Blocked) + .severity(SeverityId::High) + .status(StatusId::Failure) + .dst_endpoint(Endpoint::from_domain(host, port)) + .firewall_rule(policy_name, "credential-binding") + .message(format!( + "WebSocket credential use denied: credential is not authorized for {host}:{port}" + )) + .status_detail("credential_endpoint_mismatch") + .build() + ); + egress_emit!(crate::l7::build_credential_endpoint_mismatch_finding( policy_name, host, Some("websocket"), "Provider credential endpoint binding mismatch; WebSocket closed", - ); - egress_emit!(event); - egress_emit!(finding); + )); } async fn relay_client_to_server( @@ -1412,9 +1412,8 @@ fn emit_uninspected_credential_denial(host: &str, port: u16, policy_name: &str, "WebSocket credential traffic denied for {host}:{port}" )) .build(); - let finding = crate::l7::build_uninspected_credential_finding(host, policy_name, surface); egress_emit!(event); - egress_emit!(finding); + crate::l7::emit_uninspected_credential_finding(host, policy_name, surface); } fn inspect_websocket_text_message( diff --git a/crates/openshell-supervisor-network/src/proxy.rs b/crates/openshell-supervisor-network/src/proxy.rs index 6e3aca518a..00ec044f0b 100644 --- a/crates/openshell-supervisor-network/src/proxy.rs +++ b/crates/openshell-supervisor-network/src/proxy.rs @@ -2436,9 +2436,12 @@ where C: TokioAsyncWrite + Unpin, { let detail = destination_denial_detail(denial.kind); - egress_emit!(deny_parent: connect_span, build_forward_destination_deny_ocsf_event( - denial, peer_addr, method, host, port, path, binary, pid, ancestors, cmdline, policy, - )); + crate::telemetry::emit_decision( + [build_forward_destination_deny_ocsf_event( + denial, peer_addr, method, host, port, path, binary, pid, ancestors, cmdline, policy, + )], + Some(connect_span), + ); emit_denial_simple( denial_tx, @@ -3098,13 +3101,12 @@ async fn handle_mediated_connection( )) .status_detail(DETAIL) .build(); - let finding = crate::l7::build_uninspected_credential_finding( + egress_emit!(event); + crate::l7::emit_uninspected_credential_finding( &host_lc, policy_str, if effective_tls_skip { "tls-skip" } else { "l4" }, ); - egress_emit!(event); - egress_emit!(finding); emit_activity_simple(activity_tx.as_ref(), true, "uninspected_credentials"); emit_denial( &denial_tx, @@ -5704,18 +5706,21 @@ async fn handle_forward_proxy( let matched_policy = match &decision.action { NetworkAction::Allow { matched_policy } => matched_policy.clone(), NetworkAction::Deny { reason } => { - egress_emit!(deny_parent: &connect_span, build_forward_policy_deny_ocsf_event( - workload_addr, - method, - &host_lc, - port, - &telemetry_path, - &binary_str, - &pid_str, - &ancestors_str, - &cmdline_str, - reason, - )); + crate::telemetry::emit_decision( + [build_forward_policy_deny_ocsf_event( + workload_addr, + method, + &host_lc, + port, + &telemetry_path, + &binary_str, + &pid_str, + &ancestors_str, + &cmdline_str, + reason, + )], + Some(&connect_span), + ); emit_denial_simple( denial_tx, &host_lc, @@ -5973,19 +5978,22 @@ async fn handle_forward_proxy( if !l7_config.config.allow_encoded_slash && crate::l7::path::canonical_path_has_encoded_slash(&path) { - egress_emit!(deny_parent: &connect_span, build_forward_l7_parse_rejection_ocsf_event( - workload_addr, - method, - &host_lc, - port, - &telemetry_path, - &binary_str, - &pid_str, - &ancestors_str, - &cmdline_str, - policy_str, - FORWARD_ENCODED_SLASH_REJECTION_DETAIL, - )); + crate::telemetry::emit_decision( + [build_forward_l7_parse_rejection_ocsf_event( + workload_addr, + method, + &host_lc, + port, + &telemetry_path, + &binary_str, + &pid_str, + &ancestors_str, + &cmdline_str, + policy_str, + FORWARD_ENCODED_SLASH_REJECTION_DETAIL, + )], + Some(&connect_span), + ); emit_activity_simple(activity_tx, true, "forward_parse_rejection"); respond( client, @@ -6030,7 +6038,7 @@ async fn handle_forward_proxy( )) .status_detail(upgrade_detail) .build(); - egress_emit!(deny_parent: &connect_span, event); + crate::telemetry::emit_decision([event], Some(&connect_span)); emit_activity_simple(activity_tx, true, "l7_parse_rejection"); emit_denial_simple( denial_tx, diff --git a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs index 305869f86c..b45690dd67 100644 --- a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs +++ b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs @@ -2,7 +2,9 @@ // SPDX-License-Identifier: Apache-2.0 use super::*; -use crate::telemetry::tests::{assert_deny_resolves, exported}; +use crate::telemetry::tests::{ + assert_deny_resolves, assert_no_deny, deny_spans, exported, span_attribute, +}; use opentelemetry_proto::tonic::common::v1::any_value::Value; #[tokio::test(flavor = "multi_thread", worker_threads = 2)] @@ -36,18 +38,14 @@ async fn repeated_credential_denials_keep_decision_spans_separate() { .action(ActionId::Allowed) .dst_endpoint(Endpoint::from_domain("allowed.example", 443)) .build(); - crate::telemetry::emit(allowed, None); + egress_emit!(allowed); }) .await; assert_eq!(events.len(), 5); assert_deny_resolves(&events[..4], &received, level == "warn"); assert!(events[4].get("trace").is_none(), "deny context must exit"); - let denies = received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .collect::>(); + let denies = deny_spans(&received); assert_eq!(denies.len(), 2); assert_ne!(denies[0].span_id, denies[1].span_id); assert_eq!(received.spans.len(), if level == "debug" { 3 } else { 2 }); @@ -81,18 +79,11 @@ async fn network_class_forward_rejections_have_no_deny_trace() { 443, format!("FORWARD rejecting non-canonical request-target: {error}") )); - tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; assert_eq!(events.len(), 1); assert_eq!(events[0]["action_id"], 2); - assert!(events[0].get("trace").is_none()); - assert!( - received - .spans - .iter() - .all(|span| span.name != "supervisor.egress.deny") - ); + assert_no_deny(&events, &received); } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] @@ -143,25 +134,15 @@ async fn forward_denials_use_the_saved_connect_parent() { .await; assert_eq!(events.len(), 1); assert_deny_resolves(&events, &received, level == "warn"); - assert_eq!( - received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .count(), - 1 - ); + let denies = deny_spans(&received); + assert_eq!(denies.len(), 1); if level == "debug" { let connect = received .spans .iter() .find(|span| span.name == "supervisor.egress.connect") .unwrap(); - let deny = received - .spans - .iter() - .find(|span| span.name == "supervisor.egress.deny") - .unwrap(); + let deny = denies[0]; assert_eq!(deny.parent_span_id, connect.span_id); assert_eq!(events[0]["trace"]["uid"], hex::encode(&connect.trace_id)); } @@ -208,9 +189,6 @@ async fn forward_evaluation_error_keeps_the_http_decision_policy_context() { ); // Use the same grouping as the forward-proxy production path. emit_forward_l7_decision(decision, Some(error), &connect); - if !enforced { - tracing::info_span!("test.export-barrier").in_scope(|| {}); - } }) .await; @@ -223,24 +201,14 @@ async fn forward_evaluation_error_keeps_the_http_decision_policy_context() { .iter() .find(|event| event["class_uid"] == 4001) .unwrap(); - let denies = received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .collect::>(); + let denies = deny_spans(&received); if enforced { assert_eq!(denies.len(), 1); assert_eq!(received.spans.len(), if level == "debug" { 2 } else { 1 }); assert_eq!(http_decision["action_id"], 2); assert_eq!(evaluation_error["action_id"], 2); assert_deny_resolves(&events, &received, level == "warn"); - let attribute = |key: &str| { - denies[0] - .attributes - .iter() - .find(|attribute| attribute.key == key) - .and_then(|attribute| attribute.value.as_ref()?.value.as_ref()) - }; + let attribute = |key: &str| span_attribute(denies[0], key); assert_eq!( attribute("openshell.policy.name"), Some(&Value::StringValue("forward-policy".to_string())), @@ -263,12 +231,9 @@ async fn forward_evaluation_error_keeps_the_http_decision_policy_context() { assert_eq!(denies[0].trace_id, connect.trace_id); } } else { - assert!(denies.is_empty()); assert_eq!(http_decision["action_id"], 1); assert_eq!(evaluation_error["action_id"], 99); - for event in events { - assert!(event.get("trace").is_none()); - } + assert_no_deny(&events, &received); } } } diff --git a/crates/openshell-supervisor-network/src/telemetry.rs b/crates/openshell-supervisor-network/src/telemetry.rs index 16e06427d7..b88fb8dd1a 100644 --- a/crates/openshell-supervisor-network/src/telemetry.rs +++ b/crates/openshell-supervisor-network/src/telemetry.rs @@ -7,16 +7,12 @@ use std::collections::HashMap; use std::sync::{LazyLock, Mutex}; use std::time::{Duration, Instant}; -use openshell_ocsf::{ActionId, OcsfEvent}; +use openshell_ocsf::{ActionId, HttpActivityEvent, OcsfEvent}; -/// Emit egress events, entering an INFO deny span for denied HTTP Activity. -/// A saved connect span parents denies after authorization exits. +/// Emit one egress event, entering an INFO deny span if it is denied HTTP Activity. macro_rules! egress_emit { ($event:expr) => { - $crate::telemetry::emit($event, None) - }; - (deny_parent: $parent:expr, $event:expr) => { - $crate::telemetry::emit($event, Some($parent)) + $crate::telemetry::emit_decision([$event], None) }; } pub(crate) use egress_emit; @@ -30,26 +26,30 @@ fn is_denied(event: &OcsfEvent) -> bool { } } -/// Only HTTP Activity carries `trace`, so only a decision with an HTTP record -/// gets a deny span that an OCSF record can point to. -fn is_http(event: &OcsfEvent) -> bool { - matches!(event, OcsfEvent::HttpActivity(_)) -} - -pub fn emit(event: OcsfEvent, parent: Option<&tracing::Span>) { - emit_decision([event], parent); +fn as_http(event: &OcsfEvent) -> Option<&HttpActivityEvent> { + match event { + OcsfEvent::HttpActivity(event) => Some(event), + _ => None, + } } -/// Emit all records of one synchronous decision under one deny span. Different -/// decisions remain separate, even when they concern the same connection. +/// Emit all records of one synchronous decision under one deny span. Only HTTP +/// Activity carries `trace`, so only a denied decision with an HTTP record gets +/// a span; it is anchored on the denied HTTP record when there is one. A saved +/// `parent` keeps the span in the connect trace after authorization exits. #[allow(clippy::disallowed_macros)] pub fn emit_decision(events: impl IntoIterator, parent: Option<&tracing::Span>) { let events: Vec<_> = events.into_iter().collect(); - let denied = events.iter().any(is_denied); - let span = events - .iter() - .find(|event| denied && is_http(event)) - .and_then(|event| deny_span(event, parent)); + let span = if events.iter().any(is_denied) { + events + .iter() + .filter(|event| is_denied(event)) + .find_map(as_http) + .or_else(|| events.iter().find_map(as_http)) + .and_then(|event| deny_span(event, parent)) + } else { + None + }; let emit = || { for event in events { openshell_ocsf::ocsf_emit!(event); @@ -62,22 +62,9 @@ pub fn emit_decision(events: impl IntoIterator, parent: Option } } -/// Build a decision scope, reusing an active deny scope for its companion -/// records rather than creating another exported span. Returns `None` when the -/// destination has used up its deny spans. -pub fn deny_span(event: &OcsfEvent, parent: Option<&tracing::Span>) -> Option { - let current = tracing::Span::current(); - if current - .metadata() - .is_some_and(|metadata| metadata.name() == "supervisor.egress.deny") - { - return Some(current); - } - let (endpoint, policy) = match event { - OcsfEvent::HttpActivity(e) => (e.dst_endpoint.as_ref(), e.firewall_rule.as_ref()), - _ => (None, None), - }; - let policy = policy.map(|rule| rule.name.as_str()); +/// Returns `None` when the destination has used up its deny spans. +fn deny_span(event: &HttpActivityEvent, parent: Option<&tracing::Span>) -> Option { + let endpoint = event.dst_endpoint.as_ref(); let address = endpoint.and_then(|endpoint| endpoint.domain.as_deref().or(endpoint.ip.as_deref())); let port = endpoint.and_then(|endpoint| endpoint.port); @@ -93,58 +80,41 @@ pub fn deny_span(event: &OcsfEvent, parent: Option<&tracing::Span>) -> Option> = LazyLock::new(|| { - Mutex::new(DenySpanLimiter::new( - DENY_SPAN_BURST, - DENY_SPAN_REFILL, - DENY_SPAN_DESTINATIONS, - )) -}); +static LIMITER: LazyLock> = LazyLock::new(|| Mutex::new(default_limiter())); + +fn default_limiter() -> DenySpanLimiter { + DenySpanLimiter::new(DENY_SPAN_BURST, DENY_SPAN_REFILL, DENY_SPAN_DESTINATIONS) +} #[cfg(test)] -pub fn reset_deny_span_limiter() { +fn reset_deny_span_limiter() { *LIMITER .lock() - .unwrap_or_else(std::sync::PoisonError::into_inner) = - DenySpanLimiter::new(DENY_SPAN_BURST, DENY_SPAN_REFILL, DENY_SPAN_DESTINATIONS); + .unwrap_or_else(std::sync::PoisonError::into_inner) = default_limiter(); } /// Per-destination token bucket bounding how many deny spans one workload can /// export. OCSF records are unaffected; a limited decision just has no span. -pub struct DenySpanLimiter { +struct DenySpanLimiter { burst: u32, refill: Duration, capacity: usize, @@ -157,7 +127,7 @@ struct Bucket { } impl DenySpanLimiter { - pub fn new(burst: u32, refill: Duration, capacity: usize) -> Self { + fn new(burst: u32, refill: Duration, capacity: usize) -> Self { Self { burst, refill, @@ -166,7 +136,7 @@ impl DenySpanLimiter { } } - pub fn allow(&mut self, destination: &str, now: Instant) -> bool { + fn allow(&mut self, destination: &str, now: Instant) -> bool { if !self.buckets.contains_key(destination) && self.buckets.len() >= self.capacity { for bucket in self.buckets.values_mut() { bucket.refill(self.burst, self.refill, now); diff --git a/crates/openshell-supervisor-network/src/telemetry/tests.rs b/crates/openshell-supervisor-network/src/telemetry/tests.rs index 5cfa76ba37..24d5d4522c 100644 --- a/crates/openshell-supervisor-network/src/telemetry/tests.rs +++ b/crates/openshell-supervisor-network/src/telemetry/tests.rs @@ -4,6 +4,8 @@ use std::sync::{Arc, LazyLock, Mutex}; use openshell_otel_test_support::{OtlpTestServer, ReceivedTraces, tracing_test_lock}; +use opentelemetry_proto::tonic::common::v1::any_value::Value; +use opentelemetry_proto::tonic::trace::v1::Span; use tracing_subscriber::prelude::*; #[derive(Clone)] @@ -107,8 +109,6 @@ fn capture( } pub fn assert_deny_resolves(events: &[serde_json::Value], received: &ReceivedTraces, root: bool) { - use opentelemetry_proto::tonic::common::v1::any_value::Value; - assert!(events.iter().any(|event| event["class_uid"] == 4002)); for event in events { if event["class_uid"] != 4002 { @@ -129,12 +129,9 @@ pub fn assert_deny_resolves(events: &[serde_json::Value], received: &ReceivedTra .iter() .any(|p| p == "trace") ); - let span = received - .spans - .iter() - .find(|span| { - span.name == "supervisor.egress.deny" && hex::encode(&span.trace_id) == uid - }) + let span = deny_spans(received) + .into_iter() + .find(|span| hex::encode(&span.trace_id) == uid) .expect("OCSF trace.uid resolves to exported deny span"); if root { assert!(span.parent_span_id.is_empty()); @@ -155,11 +152,7 @@ pub fn assert_deny_resolves(events: &[serde_json::Value], received: &ReceivedTra for key in ["openshell.policy.decision", "ocsf.class_uid"] { assert!(attributes.contains(&key), "deny span carries {key}"); } - let class_uid = span - .attributes - .iter() - .find(|attribute| attribute.key == "ocsf.class_uid") - .and_then(|attribute| attribute.value.as_ref()?.value.as_ref()); + let class_uid = span_attribute(span, "ocsf.class_uid"); assert!( matches!(class_uid, Some(Value::IntValue(_))), "deny span exports ocsf.class_uid as an integer: {class_uid:?}" @@ -180,35 +173,43 @@ pub fn http_deny(host: &str, decision: &str) -> openshell_ocsf::OcsfEvent { .build() } -pub fn assert_deny_attribute(received: &ReceivedTraces, key: &str, expected: &str) { - use opentelemetry_proto::tonic::common::v1::any_value::Value; - let deny = received +pub fn deny_spans(received: &ReceivedTraces) -> Vec<&Span> { + received .spans .iter() - .find(|span| span.name == "supervisor.egress.deny") - .unwrap(); - let attribute = deny - .attributes + .filter(|span| span.name == "supervisor.egress.deny") + .collect() +} + +/// Assert that no record carries `trace` and no deny span was exported. +pub fn assert_no_deny(events: &[serde_json::Value], received: &ReceivedTraces) { + for event in events { + assert!(event.get("trace").is_none(), "{event}"); + } + assert!(deny_spans(received).is_empty()); +} + +pub fn span_attribute<'a>(span: &'a Span, key: &str) -> Option<&'a Value> { + span.attributes .iter() .find(|attribute| attribute.key == key) - .unwrap(); + .and_then(|attribute| attribute.value.as_ref()?.value.as_ref()) +} + +pub fn assert_deny_attribute(received: &ReceivedTraces, key: &str, expected: &str) { assert_eq!( - attribute.value.as_ref().unwrap().value.as_ref().unwrap(), - &Value::StringValue(expected.to_string()) + span_attribute(deny_spans(received)[0], key), + Some(&Value::StringValue(expected.to_string())) ); } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] -async fn companion_emissions_reuse_an_active_decision_scope() { +async fn companion_records_share_one_deny_span() { let (events, received) = exported("warn", || { let event = http_deny("blocked.example", "denied"); let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()).build(); - let scope = super::deny_span(&event, None).unwrap(); - scope.in_scope(|| { - super::emit(event, None); - super::emit(finding, None); - }); + super::emit_decision([event, finding], None); }) .await; assert_eq!(events.len(), 2); @@ -243,15 +244,10 @@ async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { ) .message(&decision) .build(); - let scope = super::deny_span(&event, None).unwrap(); - scope.in_scope(|| { - super::emit(event, None); - // Both threads keep different deny scopes entered - // while their companion records interleave. - barrier.wait(); - super::emit(finding, None); - barrier.wait(); - }); + super::emit_decision([event, finding], None); + // Both threads finish each decision before either + // starts the next. + barrier.wait(); } }); openshell_ocsf::ctx::bind_thread_ctx(None); @@ -265,25 +261,12 @@ async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { assert_eq!(events.len(), 8); assert_deny_resolves(&events, &received, level == "warn"); - let denies = received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .collect::>(); + let denies = deny_spans(&received); assert_eq!(denies.len(), 4); assert_eq!(received.spans.len(), if level == "debug" { 6 } else { 4 }); - let attribute = |span: &opentelemetry_proto::tonic::trace::v1::Span, key: &str| { - use opentelemetry_proto::tonic::common::v1::any_value::Value; - match span - .attributes - .iter() - .find(|attribute| attribute.key == key) - .and_then(|attribute| attribute.value.as_ref()) - .and_then(|value| value.value.as_ref()) - { - Some(Value::StringValue(value)) => value.clone(), - other => panic!("expected string attribute {key}, got {other:?}"), - } + let attribute = |span: &Span, key: &str| match span_attribute(span, key) { + Some(Value::StringValue(value)) => value.clone(), + other => panic!("expected string attribute {key}, got {other:?}"), }; let mut traces_by_host = Vec::new(); for host in ["alpha.example", "beta.example"] { @@ -343,6 +326,28 @@ async fn concurrent_decisions_keep_companions_and_request_contexts_separate() { } } +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn deny_span_describes_the_denied_http_record() { + let (events, received) = exported("warn", || { + let allowed = openshell_ocsf::HttpActivityBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Allowed) + .http_request(openshell_ocsf::HttpRequest::new( + "GET", + openshell_ocsf::Url::new("https", "allowed.example", "/", 443), + )) + .dst_endpoint(openshell_ocsf::Endpoint::from_domain( + "allowed.example", + 443, + )) + .build(); + super::emit_decision([allowed, http_deny("blocked.example", "denied")], None); + }) + .await; + assert_deny_resolves(&events, &received, true); + assert_deny_attribute(&received, "server.address", "blocked.example"); + assert_deny_attribute(&received, "openshell.policy.reason", "denied"); +} + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn missing_deny_context_leaves_optional_attributes_unset() { let (events, received) = exported("warn", || { @@ -354,7 +359,7 @@ async fn missing_deny_context_leaves_optional_attributes_unset() { }) .message("diagnostic text is not a policy reason") .build(); - super::emit(http, None); + super::egress_emit!(http); }) .await; assert_deny_resolves(&events, &received, true); @@ -389,19 +394,10 @@ async fn denials_without_an_http_record_do_not_open_deny_spans() { .action(openshell_ocsf::ActionId::Denied) .build(); super::emit_decision([network, finding], None); - tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; assert_eq!(events.len(), 2); - for event in events { - assert!(event.get("trace").is_none()); - } - assert!( - received - .spans - .iter() - .all(|span| span.name != "supervisor.egress.deny") - ); + assert_no_deny(&events, &received); } #[tokio::test(flavor = "multi_thread", worker_threads = 2)] @@ -414,26 +410,16 @@ async fn allowed_emissions_do_not_create_info_deny_spans() { 443, )) .build(); - super::emit(allowed, None); + super::egress_emit!(allowed); crate::l7::middleware::emit_middleware_uninspectable( &crate::l7::relay::L7EvalContext::default(), "unknown protocol", false, ); - // Flush an unrelated INFO span so the collector wait is bounded by an export. - tracing::info_span!("test.export-barrier").in_scope(|| {}); }) .await; assert_eq!(events.len(), 2); - for event in events { - assert!(event.get("trace").is_none()); - } - assert!( - !received - .spans - .iter() - .any(|span| span.name == "supervisor.egress.deny") - ); + assert_no_deny(&events, &received); } #[test] @@ -478,16 +464,12 @@ fn deny_span_limiter_bounds_tracked_destinations() { async fn repeated_denials_to_one_destination_export_bounded_spans() { let (events, received) = exported("warn", || { for _ in 0..(super::DENY_SPAN_BURST + 5) { - super::emit(http_deny("loop.example", "denied"), None); + super::egress_emit!(http_deny("loop.example", "denied")); } - super::emit(http_deny("other.example", "denied"), None); + super::egress_emit!(http_deny("other.example", "denied")); }) .await; - let denies = received - .spans - .iter() - .filter(|span| span.name == "supervisor.egress.deny") - .count(); + let denies = deny_spans(&received).len(); assert_eq!(denies, super::DENY_SPAN_BURST as usize + 1); let traced = events .iter() From 2bb7e0155c9ced9d428a7f79f17d65b31bcd5d7f Mon Sep 17 00:00:00 2001 From: Kris Hicks Date: Thu, 5 Nov 2026 11:11:53 -0800 Subject: [PATCH 11/12] fix(supervisor-network): keep FORWARD denials in the connect trace At debug level, FORWARD credential-binding and request middleware denials opened root deny spans, because the saved connect span exists there but is not entered. Deny spans also charged the per-destination limiter even when they were disabled, and a fail-closed WebSocket middleware finding did not record the denial its HTTP counterparts do. Those denials now pass or run under the saved connect span, the limiter is consulted only when INFO spans are enabled, and the fail-closed WebSocket finding sets action Denied. Signed-off-by: Kris Hicks --- .../src/l7/middleware.rs | 43 ++++++++++++++++++- .../openshell-supervisor-network/src/proxy.rs | 29 ++++++++++--- .../src/proxy/trace_tests.rs | 28 +++++++----- .../src/telemetry.rs | 11 +++-- .../src/telemetry/tests.rs | 12 ++++++ 5 files changed, 102 insertions(+), 21 deletions(-) diff --git a/crates/openshell-supervisor-network/src/l7/middleware.rs b/crates/openshell-supervisor-network/src/l7/middleware.rs index 495d02d1ad..e4e23a5296 100644 --- a/crates/openshell-supervisor-network/src/l7/middleware.rs +++ b/crates/openshell-supervisor-network/src/l7/middleware.rs @@ -388,8 +388,13 @@ fn emit_websocket_invocations( .build(); egress_emit!(event); if invocation.failed { - let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) - .severity(if invocation.outcome == Outcome::FailClosed { + let fail_closed = invocation.outcome == Outcome::FailClosed; + let mut finding = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()); + if fail_closed { + finding = finding.action(ActionId::Denied); + } + let event = finding + .severity(if fail_closed { SeverityId::High } else { SeverityId::Medium @@ -1052,6 +1057,40 @@ mod trace_tests { } } + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn websocket_fail_closed_findings_record_the_denial() { + use openshell_supervisor_middleware::{ + WebSocketInvocation, WebSocketInvocationOutcome as Outcome, + }; + for (outcome, action_id) in [(Outcome::FailClosed, Some(2)), (Outcome::FailOpen, None)] { + let (events, _) = exported("warn", || { + emit_websocket_invocations( + &L7EvalContext::default(), + &[WebSocketInvocation { + config_name: "guard".to_string(), + implementation: "test/guard".to_string(), + outcome, + sequence: None, + original_size: 0, + replacement_size: None, + transformed: false, + failed: true, + stage_disabled: false, + reason_code: None, + }], + ); + }) + .await; + let finding = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.websocket_failure" + }) + .unwrap(); + assert_eq!(finding["action_id"].as_u64(), action_id, "{outcome:?}"); + } + } + #[test] fn refusal_findings_record_the_denial() { for reason in [ diff --git a/crates/openshell-supervisor-network/src/proxy.rs b/crates/openshell-supervisor-network/src/proxy.rs index 00ec044f0b..96c0b8f50a 100644 --- a/crates/openshell-supervisor-network/src/proxy.rs +++ b/crates/openshell-supervisor-network/src/proxy.rs @@ -247,7 +247,13 @@ fn build_credential_endpoint_mismatch_event( .build() } -fn emit_credential_endpoint_mismatch(method: &str, host: &str, port: u16, policy_name: &str) { +fn emit_credential_endpoint_mismatch( + method: &str, + host: &str, + port: u16, + policy_name: &str, + connect_span: &tracing::Span, +) { let event = build_credential_endpoint_mismatch_event(method, host, port, policy_name); let finding = crate::l7::build_credential_endpoint_mismatch_finding( policy_name, @@ -255,7 +261,7 @@ fn emit_credential_endpoint_mismatch(method: &str, host: &str, port: u16, policy None, "Provider credential endpoint binding mismatch; request denied", ); - crate::telemetry::emit_decision([event, finding], None); + crate::telemetry::emit_decision([event, finding], Some(connect_span)); } /// Hostnames injected by compute drivers as `/etc/hosts` aliases for the host @@ -6490,7 +6496,12 @@ async fn handle_forward_proxy( exchange: &middleware_exchange, l7_reevaluation, }; - forward_request_bytes = match pipeline.apply(request, client).await? { + // Middleware denials join the connect trace, like other FORWARD denials. + forward_request_bytes = match pipeline + .apply(request, client) + .instrument(connect_span.clone()) + .await? + { crate::l7::middleware::MiddlewareApplyResult::Allowed(request) => request.raw_header, crate::l7::middleware::MiddlewareApplyResult::Denied { denial, .. } => { emit_activity_simple(activity_tx, true, "middleware"); @@ -6671,13 +6682,21 @@ async fn handle_forward_proxy( .await; } if e.is_placement_mismatch() { - crate::l7::relay::reject_credential_resolution(client, &l7_ctx, method, &e).await?; + crate::l7::relay::reject_credential_resolution(client, &l7_ctx, method, &e) + .instrument(connect_span.clone()) + .await?; client.shutdown().await.into_diagnostic()?; } else if e.is_endpoint_mismatch() { if let Some(observer) = endpoint_observer.as_ref() { observer.observe_credential_failure(true); } - emit_credential_endpoint_mismatch(method, &host_lc, port, policy_str); + emit_credential_endpoint_mismatch( + method, + &host_lc, + port, + policy_str, + &connect_span, + ); respond( client, &build_json_error_response( diff --git a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs index b45690dd67..1602913885 100644 --- a/crates/openshell-supervisor-network/src/proxy/trace_tests.rs +++ b/crates/openshell-supervisor-network/src/proxy/trace_tests.rs @@ -10,7 +10,13 @@ use opentelemetry_proto::tonic::common::v1::any_value::Value; #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn paired_credential_denial_shares_one_deny_span() { let (events, received) = exported("warn", || { - emit_credential_endpoint_mismatch("POST", "blocked.example", 443, "credential-policy"); + emit_credential_endpoint_mismatch( + "POST", + "blocked.example", + 443, + "credential-policy", + &tracing::Span::none(), + ); }) .await; assert_eq!(events.len(), 2); @@ -24,16 +30,16 @@ async fn repeated_credential_denials_keep_decision_spans_separate() { let (events, received) = exported(level, || { let connect = egress::connect_span(&EgressIntent::connect("blocked.example".to_string(), 443)); - connect.in_scope(|| { - for _ in 0..2 { - emit_credential_endpoint_mismatch( - "POST", - "blocked.example", - 443, - "credential-policy", - ); - } - }); + // The FORWARD path passes its saved connect span without entering it. + for _ in 0..2 { + emit_credential_endpoint_mismatch( + "POST", + "blocked.example", + 443, + "credential-policy", + &connect, + ); + } let allowed = NetworkActivityBuilder::new(openshell_ocsf::ctx::ctx()) .action(ActionId::Allowed) .dst_endpoint(Endpoint::from_domain("allowed.example", 443)) diff --git a/crates/openshell-supervisor-network/src/telemetry.rs b/crates/openshell-supervisor-network/src/telemetry.rs index b88fb8dd1a..b3c2e43c63 100644 --- a/crates/openshell-supervisor-network/src/telemetry.rs +++ b/crates/openshell-supervisor-network/src/telemetry.rs @@ -35,8 +35,9 @@ fn as_http(event: &OcsfEvent) -> Option<&HttpActivityEvent> { /// Emit all records of one synchronous decision under one deny span. Only HTTP /// Activity carries `trace`, so only a denied decision with an HTTP record gets -/// a span; it is anchored on the denied HTTP record when there is one. A saved -/// `parent` keeps the span in the connect trace after authorization exits. +/// a span. The span describes the denied HTTP record, or the first HTTP record +/// when only a companion finding is denied. A saved `parent` keeps the span in +/// the connect trace after authorization exits. #[allow(clippy::disallowed_macros)] pub fn emit_decision(events: impl IntoIterator, parent: Option<&tracing::Span>) { let events: Vec<_> = events.into_iter().collect(); @@ -62,8 +63,12 @@ pub fn emit_decision(events: impl IntoIterator, parent: Option } } -/// Returns `None` when the destination has used up its deny spans. +/// Returns `None` when deny spans are disabled or the destination has used up +/// its deny spans. Disabled spans spend no tokens. fn deny_span(event: &HttpActivityEvent, parent: Option<&tracing::Span>) -> Option { + if !tracing::enabled!(kind: tracing::metadata::Kind::SPAN, tracing::Level::INFO) { + return None; + } let endpoint = event.dst_endpoint.as_ref(); let address = endpoint.and_then(|endpoint| endpoint.domain.as_deref().or(endpoint.ip.as_deref())); diff --git a/crates/openshell-supervisor-network/src/telemetry/tests.rs b/crates/openshell-supervisor-network/src/telemetry/tests.rs index 24d5d4522c..037d012a4f 100644 --- a/crates/openshell-supervisor-network/src/telemetry/tests.rs +++ b/crates/openshell-supervisor-network/src/telemetry/tests.rs @@ -478,3 +478,15 @@ async fn repeated_denials_to_one_destination_export_bounded_spans() { assert_eq!(traced, denies, "limited records carry no trace.uid"); assert_eq!(events.len(), super::DENY_SPAN_BURST as usize + 6); } + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn disabled_deny_spans_spend_no_tokens() { + let _lock = tracing_test_lock().await; + super::reset_deny_span_limiter(); + let subscriber = + tracing_subscriber::registry().with(tracing_subscriber::filter::LevelFilter::WARN); + tracing::subscriber::with_default(subscriber, || { + super::egress_emit!(http_deny("quiet.example", "denied")); + }); + assert!(super::LIMITER.lock().unwrap().buckets.is_empty()); +} From 4f827abc93d017fd9fb55b1ae171853bc425bbd0 Mon Sep 17 00:00:00 2001 From: Harry Turner Date: Fri, 6 Nov 2026 20:04:49 +1000 Subject: [PATCH 12/12] fix(supervisor-network): classify refusals and bound deny spans Mark remaining inspection, capacity, admission and response refusals as Denied while preserving fail-open and I/O error classification. Add a process-wide deny-span budget alongside destination limits, with audit-preservation tests and matching documentation. Signed-off-by: Harry Turner --- .../src/l7/middleware.rs | 104 ++++++++++++++--- .../src/l7/mod.rs | 1 + .../src/l7/rest.rs | 60 +++++++++- .../src/l7/rest/http_response.rs | 9 ++ .../src/telemetry.rs | 42 ++++++- .../src/telemetry/tests.rs | 110 ++++++++++++++++++ docs/observability/ocsf-json-export.mdx | 4 +- 7 files changed, 305 insertions(+), 25 deletions(-) diff --git a/crates/openshell-supervisor-network/src/l7/middleware.rs b/crates/openshell-supervisor-network/src/l7/middleware.rs index e4e23a5296..73c317be6f 100644 --- a/crates/openshell-supervisor-network/src/l7/middleware.rs +++ b/crates/openshell-supervisor-network/src/l7/middleware.rs @@ -147,7 +147,7 @@ pub fn uninspectable_traffic_gate( /// Emit the detection finding for traffic a matching middleware chain cannot /// inspect: denied under a fail-closed chain, bypassed under fail-open. pub fn emit_middleware_uninspectable(ctx: &L7EvalContext, detail: &str, denied: bool) { - let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + let mut event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(if denied { SeverityId::High } else { @@ -167,9 +167,11 @@ pub fn emit_middleware_uninspectable(ctx: &L7EvalContext, detail: &str, denied: "Uninspectable traffic to host with required middleware; denied" } else { "Uninspectable traffic bypassed middleware (fail_open)" - }) - .build(); - egress_emit!(event); + }); + if denied { + event = event.action(ActionId::Denied); + } + egress_emit!(event.build()); } pub fn emit_websocket_preflight_events( @@ -185,7 +187,7 @@ pub fn emit_websocket_preflight_events( emit_websocket_saturation(ctx); } if outcome.session_capacity_exhausted { - emit_middleware_session_capacity_exhausted(ctx); + emit_middleware_session_capacity_exhausted(ctx, !outcome.allowed); } } @@ -454,8 +456,8 @@ fn emit_websocket_saturation(ctx: &L7EvalContext) { egress_emit!(event); } -fn emit_middleware_session_capacity_exhausted(ctx: &L7EvalContext) { - let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) +fn emit_middleware_session_capacity_exhausted(ctx: &L7EvalContext, denied: bool) { + let mut event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(SeverityId::Medium) .finding_info(FindingInfo::new( "openshell.middleware.session_capacity_exhausted", @@ -466,13 +468,16 @@ fn emit_middleware_session_capacity_exhausted(ctx: &L7EvalContext) { ("host", ctx.host.as_str()), ("operation", "websocket_message"), ]) - .message("Persistent middleware session admission was refused at process capacity") - .build(); - egress_emit!(event); + .message("Persistent middleware session admission was refused at process capacity"); + if denied { + event = event.action(ActionId::Denied); + } + egress_emit!(event.build()); } fn middleware_admission_exhausted_event(ctx: &L7EvalContext) -> openshell_ocsf::OcsfEvent { DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .action(ActionId::Denied) .severity(SeverityId::Medium) .finding_info(FindingInfo::new( "openshell.middleware.admission_exhausted", @@ -796,7 +801,7 @@ pub(super) fn resolve_unbuffered_body( } fn emit_middleware_body_unavailable(ctx: &L7EvalContext, denied: bool) { - let event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + let mut event = DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) .severity(if denied { SeverityId::High } else { @@ -815,9 +820,11 @@ fn emit_middleware_body_unavailable(ctx: &L7EvalContext, denied: bool) { "Request body exceeded middleware inspection cap; denied" } else { "Request body exceeded middleware inspection cap; passed through (fail_open)" - }) - .build(); - egress_emit!(event); + }); + if denied { + event = event.action(ActionId::Denied); + } + egress_emit!(event.build()); } /// Parse the raw header block into middleware-visible headers, preserving @@ -1109,6 +1116,71 @@ mod trace_tests { } } + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn inspection_refusals_record_denial_but_fail_open_findings_do_not() { + for denied in [false, true] { + let (events, received) = exported("warn", || { + let ctx = L7EvalContext::default(); + emit_middleware_uninspectable(&ctx, "unknown protocol", denied); + emit_middleware_body_unavailable(&ctx, denied); + }) + .await; + assert_eq!(events.len(), 2); + for (event, uid) in events.iter().zip([ + "openshell.middleware.traffic_uninspectable", + "openshell.middleware.body_unavailable", + ]) { + assert_eq!(event["finding_info"]["uid"], uid); + assert_eq!(event["class_uid"], 2004); + assert_eq!(event["action_id"].as_u64(), denied.then_some(2)); + assert_eq!(event["action"].as_str(), denied.then_some("Denied")); + if !denied { + assert!(event.get("action_id").is_none()); + assert!(event.get("action").is_none()); + } + } + // A finding-only refusal still creates no HTTP deny span. + assert_no_deny(&events, &received); + } + } + + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn session_capacity_findings_follow_the_preflight_outcome() { + for allowed in [true, false] { + let (events, received) = exported("warn", || { + emit_websocket_preflight_events( + &L7EvalContext::default(), + &openshell_supervisor_middleware::WebSocketPreflightResult { + allowed, + terminal_reason: None, + reason: "middleware_session_capacity_exhausted".into(), + denial: None, + session: None, + findings: vec![], + metadata: std::collections::BTreeMap::new(), + invocations: vec![], + coverage: vec![], + saturated: false, + session_capacity_exhausted: true, + }, + ); + }) + .await; + assert_eq!(events.len(), 1); + assert_eq!( + events[0]["finding_info"]["uid"], + "openshell.middleware.session_capacity_exhausted" + ); + assert_eq!(events[0]["action_id"].as_u64(), (!allowed).then_some(2)); + assert_eq!(events[0]["action"].as_str(), (!allowed).then_some("Denied")); + if allowed { + assert!(events[0].get("action_id").is_none()); + assert!(events[0].get("action").is_none()); + } + assert_no_deny(&events, &received); + } + } + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn http_chain_outcomes_group_findings_and_preserve_allowed_controls() { for allowed in [true, false] { @@ -1169,6 +1241,10 @@ mod tests { let serialized = serde_json::to_string(&middleware_admission_exhausted_event(&ctx)) .expect("serialize admission event"); + let event: serde_json::Value = serde_json::from_str(&serialized).unwrap(); + assert_eq!(event["class_uid"], 2004); + assert_eq!(event["action_id"], 2); + assert_eq!(event["action"], "Denied"); assert!(serialized.contains("openshell.middleware.admission_exhausted")); assert!(serialized.contains("api-policy")); assert!(serialized.contains("api.example.test")); diff --git a/crates/openshell-supervisor-network/src/l7/mod.rs b/crates/openshell-supervisor-network/src/l7/mod.rs index 43efece737..bc01d0bbdd 100644 --- a/crates/openshell-supervisor-network/src/l7/mod.rs +++ b/crates/openshell-supervisor-network/src/l7/mod.rs @@ -462,6 +462,7 @@ pub fn parse_l7_config(val: ®orus::Value) -> Option { pub(crate) fn emit_uninspected_credential_finding(host: &str, policy_name: &str, surface: &str) { let event = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.credentials.traffic_uninspectable", diff --git a/crates/openshell-supervisor-network/src/l7/rest.rs b/crates/openshell-supervisor-network/src/l7/rest.rs index f59374eea1..97c71f09b3 100644 --- a/crates/openshell-supervisor-network/src/l7/rest.rs +++ b/crates/openshell-supervisor-network/src/l7/rest.rs @@ -1536,6 +1536,7 @@ fn emit_uninspected_body_credential_denial( .build(); crate::telemetry::egress_emit!(event); let finding = openshell_ocsf::DetectionFindingBuilder::new(openshell_ocsf::ctx::ctx()) + .action(openshell_ocsf::ActionId::Denied) .severity(openshell_ocsf::SeverityId::High) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.credentials.traffic_uninspectable", @@ -6977,6 +6978,43 @@ mod tests { } } + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] + async fn credential_refusal_findings_record_denial_without_http_spans() { + let request = L7Request { + action: "POST".into(), + target: "/api".into(), + query_params: HashMap::new(), + raw_header: vec![], + body_length: BodyLength::None, + }; + let (events, received) = crate::telemetry::tests::exported("warn", || { + crate::l7::emit_uninspected_credential_finding("example.test", "p", "test"); + emit_uninspected_body_credential_denial( + &request, + &RelayRequestOptions { + host: "example.test", + port: 443, + ..Default::default() + }, + BodyCredentialError::KnownUnavailable, + ); + }) + .await; + assert_eq!(events.len(), 3); + assert_eq!( + events + .iter() + .filter(|event| event["class_uid"] == 2004) + .count(), + 2 + ); + for event in &events { + assert_eq!(event["action_id"], 2); + assert_eq!(event["action"], "Denied"); + } + crate::telemetry::tests::assert_no_deny(&events, &received); + } + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn response_trace_upstream_io_failure_is_not_an_enforced_denial() { struct FailedReader; @@ -7024,8 +7062,14 @@ mod tests { }); }) .await; - assert!(events.iter().any(|event| event["finding_info"]["uid"] - == "openshell.middleware.http_response_failure")); + let finding = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.http_response_failure" + }) + .expect("upstream I/O failure retains its diagnostic finding"); + assert!(finding.get("action_id").is_none()); + assert!(finding.get("action").is_none()); crate::telemetry::tests::assert_no_deny(&events, &received); } } @@ -7085,10 +7129,14 @@ mod tests { }); }) .await; - assert!( - events.iter().any(|event| event["finding_info"]["uid"] - == "openshell.middleware.http_response_failure") - ); + let finding = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.http_response_failure" + }) + .expect("downstream I/O failure retains its diagnostic finding"); + assert!(finding.get("action_id").is_none()); + assert!(finding.get("action").is_none()); crate::telemetry::tests::assert_no_deny(&events, &received); } diff --git a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs index a8e080b8ac..0113dc4323 100644 --- a/crates/openshell-supervisor-network/src/l7/rest/http_response.rs +++ b/crates/openshell-supervisor-network/src/l7/rest/http_response.rs @@ -1034,6 +1034,7 @@ fn http_response_middleware_block_finding_event( } Some( openshell_ocsf::DetectionFindingBuilder::new(ocsf_ctx()) + .action(openshell_ocsf::ActionId::Denied) .severity(openshell_ocsf::SeverityId::Medium) .finding_info(openshell_ocsf::FindingInfo::new( "openshell.middleware.http_response_blocked", @@ -2239,6 +2240,14 @@ mod tests { // A blocking invocation adds its own block finding. assert_eq!(events.len(), if denied { 3 } else { 2 }); if denied { + let blocked = events + .iter() + .find(|event| { + event["finding_info"]["uid"] == "openshell.middleware.http_response_blocked" + }) + .expect("blocked delivery emits its refusal finding"); + assert_eq!(blocked["action_id"], 2); + assert_eq!(blocked["action"], "Denied"); assert_eq!(received.spans.len(), 1); assert_deny_resolves(&events, &received, true); } else { diff --git a/crates/openshell-supervisor-network/src/telemetry.rs b/crates/openshell-supervisor-network/src/telemetry.rs index b3c2e43c63..73e573b985 100644 --- a/crates/openshell-supervisor-network/src/telemetry.rs +++ b/crates/openshell-supervisor-network/src/telemetry.rs @@ -103,6 +103,9 @@ fn deny_span(event: &HttpActivityEvent, parent: Option<&tracing::Span>) -> Optio const DENY_SPAN_BURST: u32 = 10; const DENY_SPAN_REFILL: Duration = Duration::from_secs(1); const DENY_SPAN_DESTINATIONS: usize = 1024; +/// Bound aggregate span creation even when a workload rotates destinations. +const DENY_SPAN_GLOBAL_BURST: u32 = 100; +const DENY_SPAN_GLOBAL_REFILL: Duration = Duration::from_millis(10); static LIMITER: LazyLock> = LazyLock::new(|| Mutex::new(default_limiter())); @@ -117,13 +120,16 @@ fn reset_deny_span_limiter() { .unwrap_or_else(std::sync::PoisonError::into_inner) = default_limiter(); } -/// Per-destination token bucket bounding how many deny spans one workload can -/// export. OCSF records are unaffected; a limited decision just has no span. +/// Per-destination and process-wide token buckets bounding deny-span work. +/// OCSF records are unaffected; a limited decision creates no additional span. struct DenySpanLimiter { burst: u32, refill: Duration, capacity: usize, buckets: HashMap, + global_burst: u32, + global_refill: Duration, + global: Option, } struct Bucket { @@ -133,15 +139,42 @@ struct Bucket { impl DenySpanLimiter { fn new(burst: u32, refill: Duration, capacity: usize) -> Self { + Self::with_global_limit( + burst, + refill, + capacity, + DENY_SPAN_GLOBAL_BURST, + DENY_SPAN_GLOBAL_REFILL, + ) + } + + fn with_global_limit( + burst: u32, + refill: Duration, + capacity: usize, + global_burst: u32, + global_refill: Duration, + ) -> Self { Self { burst, refill, capacity, buckets: HashMap::new(), + global_burst, + global_refill, + global: None, } } fn allow(&mut self, destination: &str, now: Instant) -> bool { + let global = self.global.get_or_insert(Bucket { + tokens: self.global_burst, + refilled: now, + }); + global.refill(self.global_burst, self.global_refill, now); + if global.tokens == 0 { + return false; + } if !self.buckets.contains_key(destination) && self.buckets.len() >= self.capacity { for bucket in self.buckets.values_mut() { bucket.refill(self.burst, self.refill, now); @@ -161,7 +194,10 @@ impl DenySpanLimiter { }); bucket.refill(self.burst, self.refill, now); let allowed = bucket.tokens > 0; - bucket.tokens = bucket.tokens.saturating_sub(1); + if allowed { + bucket.tokens -= 1; + global.tokens -= 1; + } allowed } } diff --git a/crates/openshell-supervisor-network/src/telemetry/tests.rs b/crates/openshell-supervisor-network/src/telemetry/tests.rs index 037d012a4f..7a3388ad0d 100644 --- a/crates/openshell-supervisor-network/src/telemetry/tests.rs +++ b/crates/openshell-supervisor-network/src/telemetry/tests.rs @@ -460,6 +460,115 @@ fn deny_span_limiter_bounds_tracked_destinations() { assert!(limiter.allow("c", start + Duration::from_secs(1))); } +#[test] +fn deny_span_limiter_bounds_aggregate_bursts_and_refills() { + use std::time::{Duration, Instant}; + + let start = Instant::now(); + let mut limiter = super::DenySpanLimiter::with_global_limit( + 1, + Duration::from_secs(1), + 8, + 2, + Duration::from_millis(100), + ); + assert!(limiter.allow("a", start)); + assert!( + !limiter.allow("a", start), + "a destination rejection spends no global token" + ); + assert!(limiter.allow("b", start)); + assert!( + !limiter.allow("c", start), + "rotating destinations cannot exceed the global burst" + ); + assert!(!limiter.allow("c", start + Duration::from_millis(99))); + assert!(limiter.allow("c", start + Duration::from_millis(100))); + assert!(!limiter.allow("d", start + Duration::from_millis(100))); + let later = start + Duration::from_secs(10); + assert!(limiter.allow("a", later)); + assert!(limiter.allow("b", later)); + assert!( + !limiter.allow("c", later), + "global refill stops at its burst" + ); +} + +#[test] +fn destination_capacity_rejections_spend_no_global_tokens() { + use std::time::{Duration, Instant}; + + let start = Instant::now(); + let mut limiter = super::DenySpanLimiter::with_global_limit( + 10, + Duration::from_secs(1), + 1, + 2, + Duration::from_secs(1), + ); + assert!(limiter.allow("a", start)); + assert!(!limiter.allow("b", start)); + assert!(limiter.allow("a", start)); + assert!(!limiter.allow("a", start)); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn aggregate_deny_limit_preserves_every_audit_record() { + let (events, received) = exported("warn", || { + *super::LIMITER.lock().unwrap() = super::DenySpanLimiter::with_global_limit( + 10, + std::time::Duration::from_secs(1), + 1024, + 3, + std::time::Duration::MAX, + ); + for index in 0..12 { + super::egress_emit!(http_deny(&format!("host-{index}.example"), "denied")); + } + }) + .await; + assert_eq!( + events.len(), + 12, + "the span budget never suppresses audit records" + ); + assert!(events.iter().all(|event| event["action_id"] == 2)); + assert_eq!(deny_spans(&received).len(), 3); + assert_eq!( + events + .iter() + .filter(|event| event.get("trace").is_some()) + .count(), + 3 + ); +} + +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn limited_denial_keeps_an_active_sampled_connect_trace() { + let (events, received) = exported("debug", || { + *super::LIMITER.lock().unwrap() = super::DenySpanLimiter::with_global_limit( + 1, + std::time::Duration::MAX, + 1024, + 100, + std::time::Duration::MAX, + ); + tracing::debug_span!("supervisor.egress.connect").in_scope(|| { + super::egress_emit!(http_deny("blocked.example", "first")); + super::egress_emit!(http_deny("blocked.example", "limited")); + }); + }) + .await; + assert_eq!(events.len(), 2); + assert_eq!(deny_spans(&received).len(), 1); + let connect = received + .spans + .iter() + .find(|span| span.name == "supervisor.egress.connect") + .unwrap(); + assert_eq!(events[1]["trace"]["uid"], hex::encode(&connect.trace_id)); +} + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn repeated_denials_to_one_destination_export_bounded_spans() { let (events, received) = exported("warn", || { @@ -489,4 +598,5 @@ async fn disabled_deny_spans_spend_no_tokens() { super::egress_emit!(http_deny("quiet.example", "denied")); }); assert!(super::LIMITER.lock().unwrap().buckets.is_empty()); + assert!(super::LIMITER.lock().unwrap().global.is_none()); } diff --git a/docs/observability/ocsf-json-export.mdx b/docs/observability/ocsf-json-export.mdx index af1c3927b0..2f4b52c10f 100644 --- a/docs/observability/ocsf-json-export.mdx +++ b/docs/observability/ocsf-json-export.mdx @@ -311,9 +311,9 @@ HTTP Activity and API Activity records emitted inside a sampled OpenTelemetry sp OTLP log export links every OCSF record, whatever its class, to the active sampled span through the log record's own trace and span ID fields. Use those fields for log-to-trace links in your backend. -With OTLP trace export enabled on a dedicated supervisor, each denied HTTP request creates an INFO `supervisor.egress.deny` span around the audit records for that decision. The span records the policy, reason, and destination when available. At the default log level, every deny span is a root span. At debug level, FORWARD proxy denials made before the request is relayed, including request middleware denials, join the connect trace and its authorization, resolve, and dial spans. Other deny spans, including L7 denials inside CONNECT tunnels and response middleware denials, remain root spans. Shared supervisor hosts do not initialize OTLP exporters, so their records carry no trace correlation. Workload `traceparent` headers never supply supervisor correlation. +With OTLP trace export enabled on a dedicated supervisor, denied HTTP requests can create an INFO `supervisor.egress.deny` span around the audit records for that decision. The span records the policy, reason, and destination when available. At the default log level, every deny span is a root span. At debug level, FORWARD policy, destination, credential-binding, and request middleware denials can join the available connect trace and its authorization, resolve, and dial spans. Other deny spans, including L7 denials inside CONNECT tunnels and response middleware denials, remain root spans. Shared supervisor hosts do not initialize OTLP exporters, so their records carry no trace correlation. Workload `traceparent` headers never supply supervisor correlation. -To bound telemetry volume when a workload retries a blocked destination, the supervisor creates at most 10 deny spans per destination at once and one more per second after that. Records for denials past that limit omit `trace`. +To bound telemetry volume when a workload retries blocked destinations, the supervisor creates at most 10 deny spans per destination at once and one more per second after that. A process-wide budget also allows at most 100 spans at once and refills at 100 per second across destinations. Rate-limited decisions create no additional deny span, while all audit records are still emitted. Records can retain correlation to an already active sampled span, including a connect span at debug level. Gateway records and their OTLP trace context can inherit the caller's incoming `traceparent`, including before authentication succeeds. The caller also decides whether they are correlated at all, because an unsampled `traceparent` suppresses `trace.uid`. Treat gateway trace IDs as correlation hints, not evidence of the caller's identity, and do not treat a missing `trace.uid` as meaningful.