Rule

rule

The Rule object describes characteristics of a rule associated with a policy or an event.

Attributes

Caption	Name	Type	Description
Category	`category`	String	The rule category.
Description	`desc`	String	The description of the rule that generated the event.
Name	`name`	String	The name of the rule that generated the event.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Type	`type`	String	The rule type.
Unique ID	`uid`	String	The unique identifier of the rule that generated the event.
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.
Version	`version`	String	The rule version. For example: `1.1`.

These objects and events reference Rule in their attributes:

Rule references the following objects and events in its attributes:

This page describes ocsf-1.4.0

Updated 3 days ago