The Session object describes details about an authenticated session. e.g. Session Creation Time, Session Issuer. Defined by D3FEND d3f:Session.

Attributes

CaptionNameTypeDescription
Count count Integer The number of identical sessions spawned from the same source IP, destination IP, application, and content/threat type seen over a period of time.
Created Time created_time Timestamp The time when the session was created.
User Credential ID credential_uid String The unique identifier of the user's credential. For example, AWS Access Key ID.
Expiration Reason expiration_reason String The reason which triggered the session expiration.
Expiration Time expiration_time Timestamp The session expiration time.
Multi Factor Authentication is_mfa Boolean Indicates whether Multi Factor Authentication was used during authentication.
Remote is_remote Boolean The indication of whether the session is remote.
VPN Session is_vpn Boolean The indication of whether the session is a VPN session.
Issuer Details issuer String The identifier of the session issuer.
Multi Factor Authentication mfa Boolean The Multi Factor Authentication was used during authentication.

🚧 WARNING: DEPRECATED

Multi Factor Authentication has been deprecated since 1.1.0. Deprecated in upgrade from ocsf-0.31.1 to qdm-1.1.0

Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Terminal terminal String The Pseudo Terminal associated with the session. Ex: the tty or pts value.
Unique ID uid String The unique identifier of the session.
Alternate ID uid_alt String The alternate unique identifier of the session. e.g. AWS ARN - arn:aws:sts::123344444444:assumed-role/Admin/example-session.
Unmapped Data unmapped Unmapped[] The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.
UUID uuid UUID The universally unique identifier of the session.

Relationships

Session shown in context

Inbound Relationships

These objects and events reference Session in their attributes:

Outbound Relationships

Session references the following objects and events in its attributes:

This page describes qdm-1.3.2+ocsf-1.3.0