The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may may be populated since each member is of integral type. In that case type_id if present should be set to Other.

Attributes

CaptionNameTypeDescription
Duration Milliseconds duration Long The duration of the time span in milliseconds.
Duration Days duration_days Integer The duration of the time span in days.
Duration Hours duration_hours Integer The duration of the time span in hours.
Duration Minutes duration_mins Integer The duration of the time span in minutes.
Duration Months duration_months Integer The duration of the time span in months.
Duration Seconds duration_secs Integer The duration of the time span in seconds.
Duration Weeks duration_weeks Integer The duration of the time span in weeks.
Duration Years duration_years Integer The duration of the time span in years.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Time Span Type type String The type of time span duration the object represents.
Time Span Type ID type_id Integer The normalized identifier for the time span duration type.
  • 0: Unknown (UNKNOWN)
  • 1: Milliseconds (MILLISECONDS)
  • 2: Seconds (SECONDS)
  • 3: Minutes (MINUTES)
  • 4: Hours (HOURS)
  • 5: Days (DAYS)
  • 6: Weeks (WEEKS)
  • 7: Months (MONTHS)
  • 8: Years (YEARS)
  • 99: Other (OTHER)
Unmapped Data unmapped Unmapped[] The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

Relationships

Time Span shown in context

Inbound Relationships

These objects and events reference Time Span in their attributes:

Outbound Relationships

Time Span references the following objects and events in its attributes:

This page describes qdm-1.3.2+ocsf-1.3.0