Query Information
The query info object holds information related to data access within a datastore. To access, manipulate, delete, or retrieve data from a datastore, a query must be written using a specific syntax.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Total Bytes | bytes |
Long | The size of the data returned from the query. |
| Data | data |
JSON | The data returned from the query execution. |
| Name | name |
String | The query name for a saved or scheduled query. |
| Query String | query_string |
String |
A string representing the query code being run. For example: SELECT * FROM my_table
|
| Query Time | query_time |
Timestamp | The time when the query was run. |
| Raw Data | raw_data |
JSON | The event data as received from the event source. |
| Record ID | record_id |
String | Unique identifier for the object |
| Unique ID | uid |
String | The unique identifier of the query. |
| Unmapped Data | unmapped |
Unmapped[] | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
Relationships
Inbound Relationships
These objects and events reference Query Information in their attributes:
- Kernel Object Query
- Service Query
- Registry Value Query
- Folder Query
- Datastore Activity
- User Session Query
- Prefetch Query
- Process Query
- Registry Key Query
- User Query
- Admin Group Query
- File Query
- Discovery Result
- Module Query
- Peripheral Device Query
- Networks Query
- Job Query
- Network Connection Query
Outbound Relationships
Query Information references the following objects and events in its attributes:
This page describes qdm-1.3.2+ocsf-1.3.0
Updated about 17 hours ago