Analytic

analytic

The Analytic object contains details about the analytic technique used to analyze and derive insights from the data or information that led to the creation of a finding or conclusion.

Attributes

Caption	Name	Type	Description
Algorithm	`algorithm`	String	The algorithm used by the underlying analytic to generate the finding.
Category	`category`	String	The analytic category.
Description	`desc`	String	The description of the analytic that generated the finding.
Name	`name`	String	The name of the analytic that generated the finding.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Related Analytics	`related_analytics`	Analytic[]	Other analytics related to this analytic. 🚧 WARNING: DEPRECATED Related Analytics has been deprecated since 1.0.0. Related Analytics has been decoupled from this object, instead use finding_info.related_analytics.
State	`state`	String	The Analytic state.
State ID	`state_id`	Integer	The Analytic state identifier. `1`: Active (`ACTIVE`) `2`: Suppressed (`SUPPRESSED`) `3`: Experimental (`EXPERIMENTAL`) `0`: Unknown (`UNKNOWN`) `99`: Other (`OTHER`)
Type	`type`	String	The analytic type.
Type ID	`type_id`	Integer	The analytic type ID. `0`: Unknown (`UNKNOWN`) `1`: Rule (`RULE`) `2`: Behavioral (`BEHAVIORAL`) `3`: Statistical (`STATISTICAL`) `4`: Learning (ML/DL) (`LEARNING_(ML/DL)`) `5`: Fingerprinting (`FINGERPRINTING`) `6`: Tagging (`TAGGING`) `7`: Keyword Match (`KEYWORD_MATCH`) `8`: Regular Expressions (`REGULAR_EXPRESSIONS`) `9`: Exact Data Match (`EXACT_DATA_MATCH`) `10`: Partial Data Match (`PARTIAL_DATA_MATCH`) `11`: Indexed Data Match (`INDEXED_DATA_MATCH`) `99`: Other (`OTHER`)
Unique ID	`uid`	String	The unique identifier of the analytic that generated the finding.
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.
Version	`version`	String	The analytic version. For example: 1.1.

Relationships

Inbound Relationships

These objects and events reference Analytic in their attributes:

Outbound Relationships

Analytic references the following objects and events in its attributes:

This page describes qdm-1.5.1+ocsf-1.6.0

Updated 16 days ago