Key:Value object
key_value_object
A generic object allowing to define a {key:value} pair.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Name | name |
String | The name of the key. |
| Raw Data | raw_data |
JSON |
Group:contextThe event data as received from the event source. |
| Record ID | record_id |
String |
Group:primaryUnique identifier for the object |
| Unmapped | unmapped |
Unmapped[] | Data from the source that was not mapped into the schema. |
| Value | value |
String | The value associated to the key. |
| Values | values |
String[] | Optional, the values associated to the key. You can populate this attribute, when you have multiple values for the same key. |
Relationships
Inbound Relationships
These objects and events reference Key:Value object in their attributes:
- Finding Information
- Container
- Compliance
- Web Resource
- Resource
- Service
- Databucket
- File
- Windows Service
- Account
- Related Event/Finding
- Metadata
- Resource Details
- Image
- LDAP Person
- Windows Resource
Outbound Relationships
Key:Value object references the following objects and events in its attributes:
This page describes ocsf-1.4.0
Updated 10 days ago