Operating System (OS)

os

The Operating System (OS) object describes characteristics of an OS, such as Linux or Windows.

Attributes

Caption	Name	Type	Description
OS Build	`build`	String	The operating system build number.
Country	`country`	String	Entity:`COUNTRY` The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code). Note: The two letter country code should be capitalized. For example: `US` or `CA`.
The product CPE identifier	`cpe_name`	String	The Common Platform Enumeration (CPE) name as described by (NIST) For example: `cpe:/a:apple:safari:16.2`.
CPU Bits	`cpu_bits`	Integer	The cpu architecture, the number of bits used for addressing in memory. For example: `32` or `64`.
OS Edition	`edition`	String	The operating system edition. For example: `Professional`.
Kernel Release	`kernel_release`	String	The kernel release of the operating system. On Unix-based systems, this is determined from the `uname -r` command output, for example "5.15.0-122-generic".
Language	`lang`	String	The two letter lower case language codes, as defined by ISO 639-1. For example: `en` (English), `de` (German), or `fr` (French).
Name	`name`	String	The operating system name.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
OS Service Pack	`sp_name`	String	The name of the latest Service Pack.
OS Service Pack Version	`sp_ver`	Integer	The version number of the latest Service Pack.
Type	`type`	String	The type of the operating system.
Type ID	`type_id`	Integer	The type identifier of the operating system. `0`: Unknown (`UNKNOWN`) `100`: Windows (`WINDOWS`) `101`: Windows Mobile (`WINDOWS_MOBILE`) `200`: Linux (`LINUX`) `201`: Android (`ANDROID`) `300`: macOS (`MACOS`) `301`: iOS (`IOS`) `302`: iPadOS (`IPADOS`) `400`: Solaris (`SOLARIS`) `401`: AIX (`AIX`) `402`: HP-UX (`HP_UX`) `99`: Other (`OTHER`)
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.
Version	`version`	String	The version of the OS running on the device that originated the event. For example: "Windows 10", "OS X 10.7", or "iOS 9".

Relationships

Inbound Relationships

These objects and events reference Operating System (OS) in their attributes:

Outbound Relationships

Operating System (OS) references the following objects and events in its attributes:

Unmapped

This page describes ocsf-1.4.0

Updated 6 months ago