Authorization Result

authorization

The Authorization Result object provides details about the authorization outcome and associated policies related to activity.

Attributes

Caption	Name	Type	Description
Authorization Decision/Outcome	`decision`	String	Authorization Result/outcome, e.g. allowed, denied.
Policy	`policy`	Policy[]	Details about the Identity/Access management policies that are applicable.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.

Relationships

Inbound Relationships

These objects and events reference Authorization Result in their attributes:

User Session Query
SMB Activity
Remediation Activity
Base Event
Datastore Activity
Kernel Object Query
Account Change
Network Activity
Software Inventory Info
Networks Query
Email File Activity
Module Query
Vulnerability Finding
Live Evidence Info
Tunnel Activity
Startup Item Query
File Remediation Activity
Admin Group Query
Actor
Job Query
DHCP Activity
Module Activity
Process Query
Memory Activity
Entity Management
Process Activity
Process Remediation Activity
Registry Key Activity
Registry Value Query
Device Inventory Info
Application Lifecycle
Event Log Activity
Registry Value Activity
Kernel Activity
OSINT Inventory Info
File Query
NTP Activity
HTTP Activity
User Query
Authorize Session
Prefetch Query
File System Activity
User Access Management
Application Error
Device Config State Change
Data Security Finding
Security Finding
FTP Activity
Registry Key Query
User Inventory Info
Application Security Posture Finding
API Activity
SSH Activity
Detection Finding
Peripheral Device Query
Windows Service Activity
Web Resources Activity
Authentication
Network File Activity
Group Management
Network Connection Query
IAM Analysis Finding
Email URL Activity
Incident Finding
Drone Flights Activity
Network Remediation Activity
Operating System Patch State
Scan Activity
Kernel Extension Activity
Device Config State
Cloud Resources Inventory Info
Folder Query
Airborne Broadcast Activity
DNS Activity
Windows Resource Activity
Email Activity
File Hosting Activity
Scheduled Job Activity
RDP Activity
Compliance Finding
Web Resource Access Activity
Script Activity
Service Query

Outbound Relationships

Authorization Result references the following objects and events in its attributes:

Policy
Unmapped

This page describes qdm-1.5.1+ocsf-1.6.0