Authentication Factor

auth_factor

An Authentication Factor object describes a category of methods used for identity verification in an authentication attempt.

Attributes

Caption	Name	Type	Description
Device	`device`	Device[]	Group:`primary` Device used to complete an authentication request.
Email Address	`email_addr`	Email Address	Entity:`EMAIL_ADDRESS` Group:`context` The email address used in an email-based authentication factor.
Factor Type	`factor_type`	String	Group:`primary` The type of authentication factor used in an authentication attempt.
Factor Type ID	`factor_type_id`	Integer	Group:`primary` The normalized identifier for the authentication factor. `0`: Unknown (`UNKNOWN`) `1`: SMS (`SMS`) `10`: WebAuthn (`WEBAUTHN`) `11`: Password (`PASSWORD`) `2`: Security Question (`SECURITY_QUESTION`) `3`: Phone Call (`PHONE_CALL`) `4`: Biometric (`BIOMETRIC`) `5`: Push Notification (`PUSH_NOTIFICATION`) `6`: Hardware Token (`HARDWARE_TOKEN`) `7`: OTP (`OTP`) `8`: Email (`EMAIL`) `9`: U2F (`U2F`) `99`: Other (`OTHER`)
HMAC-based One-time Password (HOTP)	`is_hotp`	Boolean	Group:`context` Whether the authentication factor is an HMAC-based One-time Password (HOTP).
Time-based One-time Password (TOTP)	`is_totp`	Boolean	Group:`context` Whether the authentication factor is a Time-based One-time Password (TOTP).
Phone Number	`phone_number`	String	Group:`context` The phone number used for a telephony-based authentication request.
Provider	`provider`	String	Group:`context` The name of provider for an authentication factor.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Security Questions	`security_questions`	String[]	Group:`context` The question(s) provided to user for a question-based authentication factor.
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.

Relationships

Inbound Relationships

These objects and events reference Authentication Factor in their attributes:

Outbound Relationships

Authentication Factor references the following objects and events in its attributes:

This page describes ocsf-1.4.0