Actor
actor
The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity. Note that Actor is not the threat actor of a campaign but may be part of a campaign.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Application Name | app_name | String | The client application or service that initiated the activity. This can be in conjunction with the user if present. Note that app_name is distinct from the process if present. |
| Application ID | app_uid | String | The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the user if present. Note that app_name is distinct from the process.pid or process.uid if present. |
| Authorization Information | authorizations | Authorization Result[] | Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event. |
| Identity Provider | idp | Identity Provider[] | This object describes details about the Identity Provider used. |
| Invoked by | invoked_by | String | The name of the service that invoked the activity as described in the event.
|
| Process | process | Linux Process[] | Entity: |
| Raw Data | raw_data | JSON | Group: |
| Record ID | record_id | String | Group: |
| Session | session | Session[] | The user session from which the activity was initiated. |
| Unmapped | unmapped | Unmapped[] | Data from the source that was not mapped into the schema. |
| User | user | User[] | Entity: |
Relationships
Inbound Relationships
These objects and events reference Actor in their attributes:
- RDP Activity
- Device Config State
- File Hosting Activity
- Email File Activity
- Software Inventory Info
- Device Inventory Info
- Kernel Object Query
- Network Activity
- File Query
- Registry Key Query
- Event Log Activity
- Registry Value Query
- User Inventory Info
- SSH Activity
- Service Query
- Drone Flights Activity
- Cloud Resources Inventory Info
- Security Finding
- Entity Management
- Process Query
- Startup Item Query
- Detection Finding
- NTP Activity
- DHCP Activity
- Network File Activity
- Web Resources Activity
- Remediation Activity
- Compliance Finding
- Vulnerability Finding
- Authentication
- Script Activity
- Scan Activity
- Windows Evidence Artifacts
- File Remediation Activity
- Process Activity
- Networks Query
- Group Management
- Registry Key Activity
- Scheduled Job Activity
- User Query
- Module Query
- DNS Activity
- Module Activity
- Incident Finding
- Airborne Broadcast Activity
- Email URL Activity
- User Access Management
- Network Remediation Activity
- Tunnel Activity
- User Session Query
- Application Error
- SMB Activity
- Network Connection Query
- Peripheral Device Query
- Windows Resource Activity
- Process Remediation Activity
- Windows Service Activity
- Operating System Patch State
- Data Security Finding
- Job Query
- Folder Query
- Prefetch Query
- Admin Group Query
- Device Config State Change
- Datastore Activity
- Email Activity
- Registry Value Activity
- IAM Analysis Finding
- Application Lifecycle
- Authorize Session
- Kernel Activity
- Application Security Posture Finding
- File System Activity
- FTP Activity
- API Activity
- Kernel Extension Activity
- Web Resource Access Activity
- Live Evidence Info
- Account Change
- Memory Activity
- HTTP Activity
- OSINT Inventory Info
- Base Event
Outbound Relationships
Actor references the following objects and events in its attributes:
This page describes qdm-1.5.1+ocsf-1.6.0
Updated 3 days ago