Key:Value object
key_value_object
A generic object allowing to define a key:value pair.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Name | name | String | The name of the key. |
| Raw Data | raw_data | JSON | Group:contextThe event data as received from the event source. |
| Record ID | record_id | String | Group:primaryUnique identifier for the object |
| Unmapped | unmapped | Unmapped[] | Data from the source that was not mapped into the schema. |
| Value | value | String | The value associated to the key. |
| Values | values | String[] | Optional, the values associated to the key. You can populate this attribute, when you have multiple values for the same key. |
Relationships
Inbound Relationships
These objects and events reference Key:Value object in their attributes:
- Windows Service
- Image
- Resource Details
- LDAP Person
- Web Resource
- Databucket
- Application
- Container
- Permission Analysis Result
- Related Event/Finding
- Account
- Finding Information
- Access Analysis Result
- Metadata
- Compliance
- File
- Service
- Windows Resource
Outbound Relationships
Key:Value object references the following objects and events in its attributes:
This page describes qdm-1.5.1+ocsf-1.6.0