Authorization Result
The Authorization Result object provides details about the authorization outcome and associated policies related to activity.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Authorization Decision/Outcome | decision |
String | Authorization Result/outcome, e.g. allowed, denied. |
| Policy | policy |
Policy[] | Details about the Identity/Access management policies that are applicable. |
| Raw Data | raw_data |
JSON | The event data as received from the event source. |
| Record ID | record_id |
String | Unique identifier for the object |
| Unmapped Data | unmapped |
Unmapped[] | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
Relationships
Inbound Relationships
These objects and events reference Authorization Result in their attributes:
- Network Activity
- Network File Activity
- RDP Activity
- SMB Activity
- Module Activity
- File System Activity
- Web Resources Activity
- Actor
- Registry Key Activity
- Email File Activity
- HTTP Activity
- Registry Value Activity
- SSH Activity
- Process Activity
- Scheduled Job Activity
- System Activity
- Event Log Activity
- Datastore Activity
- Email Activity
- Tunnel Activity
- Memory Activity
- Data Security Finding
- Email URL Activity
- FTP Activity
- NTP Activity
- DHCP Activity
- DNS Activity
- Detection Finding
- Windows Resource Activity
- Network
- Kernel Activity
- Kernel Extension Activity
- Windows Service Activity
Outbound Relationships
Authorization Result references the following objects and events in its attributes:
This page describes qdm-1.3.2+ocsf-1.3.0
Updated 6 months ago