Authorization Result

authorization

The Authorization Result object provides details about the authorization outcome and associated policies related to activity.

Attributes

Caption	Name	Type	Description
Authorization Decision/Outcome	`decision`	String	Authorization Result/outcome, e.g. allowed, denied.
Policy	`policy`	Policy[]	Details about the Identity/Access management policies that are applicable.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.

Relationships

Inbound Relationships

These objects and events reference Authorization Result in their attributes:

RDP Activity
Device Config State
File Hosting Activity
Email File Activity
Software Inventory Info
Device Inventory Info
Kernel Object Query
Network Activity
File Query
Registry Key Query
Event Log Activity
Registry Value Query
User Inventory Info
SSH Activity
Service Query
Drone Flights Activity
Cloud Resources Inventory Info
Security Finding
Entity Management
Process Query
Startup Item Query
Detection Finding
NTP Activity
DHCP Activity
Network File Activity
Web Resources Activity
Remediation Activity
Compliance Finding
Vulnerability Finding
Authentication
Script Activity
Scan Activity
File Remediation Activity
Process Activity
Networks Query
Group Management
Registry Key Activity
Scheduled Job Activity
User Query
Module Query
DNS Activity
Module Activity
Incident Finding
Airborne Broadcast Activity
Email URL Activity
User Access Management
Network Remediation Activity
Tunnel Activity
User Session Query
Application Error
SMB Activity
Network Connection Query
Peripheral Device Query
Windows Resource Activity
Process Remediation Activity
Windows Service Activity
Operating System Patch State
Data Security Finding
Job Query
Actor
Folder Query
Prefetch Query
Admin Group Query
Device Config State Change
Datastore Activity
Email Activity
Registry Value Activity
IAM Analysis Finding
Application Lifecycle
Authorize Session
Kernel Activity
Application Security Posture Finding
File System Activity
FTP Activity
API Activity
Kernel Extension Activity
Web Resource Access Activity
Live Evidence Info
Account Change
Memory Activity
HTTP Activity
OSINT Inventory Info
Base Event

Outbound Relationships

Authorization Result references the following objects and events in its attributes:

Policy
Unmapped

This page describes qdm-1.5.1+ocsf-1.6.0