Data Classification

data_classification

The Data Classification object includes information about data classification levels and data category types.

Attributes

Caption	Name	Type	Description
Category	`category`	String	The name of the data classification category that data matched into, e.g. Financial, Personal, Governmental, etc.
Category ID	`category_id`	Integer	The normalized identifier of the data classification category. `0`: Unknown (`UNKNOWN`) `1`: Personal (`PERSONAL`) `2`: Governmental (`GOVERNMENTAL`) `3`: Financial (`FINANCIAL`) `4`: Business (`BUSINESS`) `5`: Military and Law Enforcement (`MILITARY_AND_LAW_ENFORCEMENT`) `6`: Security (`SECURITY`) `99`: Other (`OTHER`)
Classifier Details	`classifier_details`	Classifier Details[]	Describes details about the classifier used for data classification.
Confidentiality	`confidentiality`	String	The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source.
Confidentiality ID	`confidentiality_id`	Integer	The normalized identifier of the file content confidentiality indicator. `0`: Unknown (`UNKNOWN`) `1`: Not Confidential (`NOT_CONFIDENTIAL`) `2`: Confidential (`CONFIDENTIAL`) `3`: Secret (`SECRET`) `4`: Top Secret (`TOP_SECRET`) `5`: Private (`PRIVATE`) `6`: Restricted (`RESTRICTED`) `99`: Other (`OTHER`)
Discovery Details	`discovery_details`	Discovery Details[]	Details about the data discovered by classification job.
Policy	`policy`	Policy[]	Details about the data policy that governs data handling and security measures related to classification.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Size	`size`	Long	Size of the data classified.
Source URL	`src_url`	URL String	Entity:`URL_STRING` The source URL pointing towards the full classifcation job details.
Status	`status`	String	The resultant status of the classification job normalized to the caption of the `status_id` value. In the case of 'Other', it is defined by the event source.
Status Details	`status_details`	String[]	The contextual description of the `status, status_id` value.
Status ID	`status_id`	Integer	The normalized status identifier of the classification job. `0`: Unknown (`UNKNOWN`) `1`: Complete (`COMPLETE`) `2`: Partial (`PARTIAL`) `3`: Fail (`FAIL`) `99`: Other (`OTHER`)
Total	`total`	Integer	The total count of discovered entities, by the classification job.
Unique ID	`uid`	String	The unique identifier of the classification job.
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.

Relationships

Inbound Relationships

These objects and events reference Data Classification in their attributes:

Outbound Relationships

Data Classification references the following objects and events in its attributes:

This page describes ocsf-1.4.0