Data Classification

The Data Classification object includes information about data classification levels and data category types.

Attributes

Caption	Name	Type	Description
Category	`category`	String	The name of the data classification category that data matched into, e.g. Financial, Personal, Governmental, etc.
Category ID	`category_id`	Integer	The normalized identifier of the data classification category. `0`: Unknown (`UNKNOWN`) `1`: Personal (`PERSONAL`) `2`: Governmental (`GOVERNMENTAL`) `3`: Financial (`FINANCIAL`) `4`: Business (`BUSINESS`) `5`: Military and Law Enforcement (`MILITARY_AND_LAW_ENFORCEMENT`) `6`: Security (`SECURITY`) `99`: Other (`OTHER`)
Confidentiality	`confidentiality`	String	The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source.
Confidentiality ID	`confidentiality_id`	Integer	The normalized identifier of the file content confidentiality indicator. `0`: Unknown (`UNKNOWN`) `1`: Not Confidential (`NOT_CONFIDENTIAL`) `2`: Confidential (`CONFIDENTIAL`) `3`: Secret (`SECRET`) `4`: Top Secret (`TOP_SECRET`) `5`: Private (`PRIVATE`) `6`: Restricted (`RESTRICTED`) `99`: Other (`OTHER`)
Policy	`policy`	Policy[]	Details about the data policy that governs data handling and security measures related to classification.
Raw Data	`raw_data`	JSON	The event data as received from the event source.
Record ID	`record_id`	String	Unique identifier for the object
Unmapped Data	`unmapped`	Unmapped[]	The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

These objects and events reference Data Classification in their attributes:

Data Classification references the following objects and events in its attributes:

This page describes qdm-1.3.2+ocsf-1.3.0