Container
container
The Container object describes an instance of a specific container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Hash | hash | Fingerprint[] | Entity: |
| Image | image | Image[] | The container image used as a template to run the container. |
| Labels | labels | String[] | The list of labels associated to the container. |
| Name | name | String | The container name. |
| Network Driver | network_driver | String | The network driver used by the container. For example, bridge, overlay, host, none, etc. |
| Orchestrator | orchestrator | String | The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. |
| Pod UUID | pod_uuid | UUID | The unique identifier of the pod (or equivalent) that the container is executing on. |
| Raw Data | raw_data | JSON | Group: |
| Record ID | record_id | String | Group: |
| Runtime | runtime | String | The backend running the container, such as containerd or cri-o. |
| Size | size | Long | The size of the container image. |
| Image Tag | tag | String | The tag used by the container. It can indicate version, format, OS.
|
| Tags | tags | Key:Value object[] | The list of tags; |
| Unique ID | uid | String | The full container unique identifier for this instantiation of the container. For example: |
| Unmapped | unmapped | Unmapped[] | Data from the source that was not mapped into the schema. |
Relationships
Inbound Relationships
These objects and events reference Container in their attributes:
- Device
- Cloud Resources Inventory Info
- Network Proxy Endpoint
- Network Endpoint
- Evidence Artifacts
- Linux Process
- Response Elements
- Endpoint
- Request Elements
Outbound Relationships
Container references the following objects and events in its attributes:
This page describes ocsf-1.4.0
Updated 6 months ago