Kernel Resource

The Kernel Resource object provides information about a specific kernel resource, including its name and type. It describes essential attributes associated with a resource managed by the kernel of an operating system. Defined by D3FEND d3f:Kernel.

Attributes

Caption	Name	Type	Description
System	`is_system`	Boolean	The indication of whether the object is part of the operating system.
Name	`name`	String	The name of the kernel resource.
Path	`path`	Path Name	The full path of the kernel resource.
Raw Data	`raw_data`	JSON	The event data as received from the event source.
Record ID	`record_id`	String	Unique identifier for the object
System Call	`system_call`	String	The system call that was invoked.
Type	`type`	String	The type of the kernel resource.
Type ID	`type_id`	Integer	The type of the kernel resource. `0`: Unknown (`UNKNOWN`) `1`: Shared Mutex (`SHARED_MUTEX`) `2`: System Call (`SYSTEM_CALL`) `3`: Named Pipe (`NAMED_PIPE`) `99`: Other (`OTHER`)
Unmapped Data	`unmapped`	Unmapped[]	The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

Relationships

Inbound Relationships

These objects and events reference Kernel Resource in their attributes:

Outbound Relationships

Kernel Resource references the following objects and events in its attributes:

Unmapped

This page describes qdm-1.3.2+ocsf-1.3.0