Actor

actor

The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity. Note that Actor is not the threat actor of a campaign but may be part of a campaign.

Attributes

Caption	Name	Type	Description
Application Name	`app_name`	String	The client application or service that initiated the activity. This can be in conjunction with the `user` if present. Note that `app_name` is distinct from the `process` if present.
Application ID	`app_uid`	String	The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the `user` if present. Note that `app_name` is distinct from the `process.pid` or `process.uid` if present.
Authorization Information	`authorizations`	Authorization Result[]	Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.
Identity Provider	`idp`	Identity Provider[]	This object describes details about the Identity Provider used.
Invoked by	`invoked_by`	String	The name of the service that invoked the activity as described in the event. 🚧 WARNING: DEPRECATED Invoked by has been deprecated since 1.2.0. Use `app_name, app_uid` attributes instead.
Process	`process`	Linux Process[]	Entity:`PROCESS` The process that initiated the activity.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Session	`session`	Session[]	The user session from which the activity was initiated.
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.
User	`user`	User[]	Entity:`USER` The user that initiated the activity or the user context from which the activity was initiated.

Relationships

Inbound Relationships

These objects and events reference Actor in their attributes:

Outbound Relationships

Actor references the following objects and events in its attributes:

This page describes ocsf-1.4.0