Actor

The Actor object contains details about the user, role, application, service, or process that initiated or performed a specific activity.

Attributes

Caption	Name	Type	Description
Application Name	`app_name`	String	The client application or service that initiated the activity. This can be in conjunction with the `user` if present. Note that `app_name` is distinct from the `process` if present.
Application ID	`app_uid`	String	The unique identifier of the client application or service that initiated the activity. This can be in conjunction with the `user` if present. Note that `app_name` is distinct from the `process.pid` or `process.uid` if present.
Authorization Information	`authorizations`	Authorization Result[]	Provides details about an authorization, such as authorization outcome, and any associated policies related to the activity/event.
Identity Provider	`idp`	Identity Provider[]	This object describes details about the Identity Provider used.
Invoked by	`invoked_by`	String	The name of the service that invoked the activity as described in the event. 🚧 WARNING: DEPRECATED Invoked by has been deprecated since 1.2.0. Use `app_name, app_uid` attributes instead.
Process	`process`	Linux Process[]	The process that initiated the activity.
Raw Data	`raw_data`	JSON	The event data as received from the event source.
Record ID	`record_id`	String	Unique identifier for the object
Session	`session`	Session[]	The user session from which the activity was initiated.
Unmapped Data	`unmapped`	Unmapped[]	The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.
User	`user`	User[]	The user that initiated the activity or the user context from which the activity was initiated.

Relationships

Inbound Relationships

These objects and events reference Actor in their attributes:

Outbound Relationships

Actor references the following objects and events in its attributes:

This page describes qdm-1.3.2+ocsf-1.3.0