Rule
rule
The Rule object describes characteristics of a rule associated with a policy or an event.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Category | category | String | The rule category. |
| Description | desc | String | The description of the rule that generated the event. |
| Name | name | String | The name of the rule that generated the event. |
| Raw Data | raw_data | JSON | Group: |
| Record ID | record_id | String | Group: |
| Type | type | String | The rule type. |
| Unique ID | uid | String | The unique identifier of the rule that generated the event. |
| Unmapped | unmapped | Unmapped[] | Data from the source that was not mapped into the schema. |
| Version | version | String | The rule version. For example: |
Relationships
Inbound Relationships
These objects and events reference Rule in their attributes:
Outbound Relationships
Rule references the following objects and events in its attributes:
This page describes ocsf-1.4.0
Updated 10 days ago