Module
The Module object describes the load attributes of a module.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Base Address | base_address |
String | The memory address where the module was loaded. |
| File | file |
File[] | The module file object. |
| Function Name | function_name |
String | The entry-point function of the module. The system calls the entry-point function whenever a process or thread loads or unloads the module. |
| Load Type | load_type |
String | The load type, normalized to the caption of the load_type_id value. In the case of 'Other', it is defined by the event source. |
| Load Type ID | load_type_id |
Integer |
The normalized identifier for how the module was loaded in memory.
|
| Raw Data | raw_data |
JSON | The event data as received from the event source. |
| Record ID | record_id |
String | Unique identifier for the object |
| Start Address | start_address |
String | The start address of the execution. |
| Type | type |
String | The module type. |
| Unmapped Data | unmapped |
Unmapped[] | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
Relationships
Inbound Relationships
These objects and events reference Module in their attributes:
Outbound Relationships
Module references the following objects and events in its attributes:
This page describes qdm-1.3.2+ocsf-1.3.0
Updated 6 months ago