Endpoint

endpoint

The Endpoint object describes a physical or virtual device that connects to and exchanges information with a computer network. Some examples of endpoints are mobile devices, desktop computers, virtual machines, embedded devices, and servers. Internet-of-Things devices—like cameras, lighting, refrigerators, security systems, smart speakers, and thermostats—are also endpoints.

Attributes

CaptionNameTypeDescription
Agent Listagent_listAgent[]

A list of agent objects associated with a device, endpoint, or resource.

ContainercontainerContainer[]

Entity:CONTAINER
Group:context
The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.

DomaindomainString

The name of the domain that the endpoint belongs to or that corresponds to the endpoint.

HostnamehostnameHostname

Entity:HOSTNAME
The fully qualified name of the endpoint.

Hardware Infohw_infoDevice Hardware Info[]

The endpoint hardware information.

Instance IDinstance_uidString

The unique identifier of a VM instance.

Network Interface Nameinterface_nameString

The name of the network interface (e.g. eth2).

Network Interface IDinterface_uidString

The unique identifier of the network interface.

IP AddressipIP Address

Entity:IP_ADDRESS
The IP address of the endpoint, in either IPv4 or IPv6 format.

Geo LocationlocationGeo Location[]

Entity:GEO_LOCATION
The geographical location of the endpoint.

MAC AddressmacMAC Address

Entity:MAC_ADDRESS
The Media Access Control (MAC) address of the endpoint.

NamenameString

The short name of the endpoint.

Namespace PIDnamespace_pidInteger

Group:context
If running under a process namespace (such as in a container), the process identifier within that process namespace.

OSosOperating System (OS)[]

The endpoint operating system.

OwnerownerUser[]

Entity:USER
The identity of the service or user account that owns the endpoint or was last logged into it.

Raw Dataraw_dataJSON

Group:context
The event data as received from the event source.

Record IDrecord_idString

Group:primary
Unique identifier for the object

Subnet UIDsubnet_uidString

The unique identifier of a virtual subnet.

TypetypeString

The endpoint type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other.

Type IDtype_idInteger

The endpoint type ID.

  • 0: Unknown (UNKNOWN)
  • 1: Server (SERVER)
  • 10: Switch (SWITCH)
  • 11: Hub (HUB)
  • 12: Router (ROUTER)
  • 13: IDS (IDS)
  • 14: IPS (IPS)
  • 15: Load Balancer (LOAD_BALANCER)
  • 2: Desktop (DESKTOP)
  • 3: Laptop (LAPTOP)
  • 4: Tablet (TABLET)
  • 5: Mobile (MOBILE)
  • 6: Virtual (VIRTUAL)
  • 7: IOT (IOT)
  • 8: Browser (BROWSER)
  • 9: Firewall (FIREWALL)
  • 99: Other (OTHER)
Unique IDuidString

The unique identifier of the endpoint.

UnmappedunmappedUnmapped[]

Data from the source that was not mapped into the schema.

VLANvlan_uidString

The Virtual LAN identifier.

VPC UIDvpc_uidString

The unique identifier of the Virtual Private Cloud (VPC).

Network ZonezoneString

The network zone or LAN segment.

Relationships

Endpoint shown in context

Outbound Relationships

Endpoint references the following objects and events in its attributes:

This page describes ocsf-1.4.0