Time Span

timespan

The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may be populated since each member is of integral type. In that case type_id if present should be set to Other.A timespan may also be defined by its time interval boundaries, start_time and end_time.

Attributes

Caption	Name	Type	Description
Duration Milliseconds	`duration`	Long	The duration of the time span in milliseconds.
Duration Days	`duration_days`	Integer	The duration of the time span in days.
Duration Hours	`duration_hours`	Integer	The duration of the time span in hours.
Duration Minutes	`duration_mins`	Integer	The duration of the time span in minutes.
Duration Months	`duration_months`	Integer	The duration of the time span in months.
Duration Seconds	`duration_secs`	Integer	The duration of the time span in seconds.
Duration Weeks	`duration_weeks`	Integer	The duration of the time span in weeks.
Duration Years	`duration_years`	Integer	The duration of the time span in years.
End Time	`end_time`	Timestamp	The end time or conclusion of the timespan's interval.
Raw Data	`raw_data`	JSON	Group:`context` The event data as received from the event source.
Record ID	`record_id`	String	Group:`primary` Unique identifier for the object
Start Time	`start_time`	Timestamp	The start time or beginning of the timespan's interval.
Time Span Type	`type`	String	The type of time span duration the object represents.
Time Span Type ID	`type_id`	Integer	The normalized identifier for the time span duration type. `0`: Unknown (`UNKNOWN`) `1`: Milliseconds (`MILLISECONDS`) `2`: Seconds (`SECONDS`) `3`: Minutes (`MINUTES`) `4`: Hours (`HOURS`) `5`: Days (`DAYS`) `6`: Weeks (`WEEKS`) `7`: Months (`MONTHS`) `8`: Years (`YEARS`) `9`: Time Interval (`TIME_INTERVAL`) `99`: Other (`OTHER`)
Unmapped	`unmapped`	Unmapped[]	Data from the source that was not mapped into the schema.

Relationships

Inbound Relationships

These objects and events reference Time Span in their attributes:

Outbound Relationships

Time Span references the following objects and events in its attributes:

Unmapped

This page describes qdm-1.5.1+ocsf-1.6.0