timespan

The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may be populated since each member is of integral type. In that case type_id if present should be set to Other.

Attributes

CaptionNameTypeDescription
Duration Milliseconds duration Long The duration of the time span in milliseconds.
Duration Days duration_days Integer The duration of the time span in days.
Duration Hours duration_hours Integer The duration of the time span in hours.
Duration Minutes duration_mins Integer The duration of the time span in minutes.
Duration Months duration_months Integer The duration of the time span in months.
Duration Seconds duration_secs Integer The duration of the time span in seconds.
Duration Weeks duration_weeks Integer The duration of the time span in weeks.
Duration Years duration_years Integer The duration of the time span in years.
Raw Data raw_data JSON Group:context
The event data as received from the event source.
Record ID record_id String Group:primary
Unique identifier for the object
Time Span Type type String The type of time span duration the object represents.
Time Span Type ID type_id Integer The normalized identifier for the time span duration type.
  • 0: Unknown (UNKNOWN)
  • 1: Milliseconds (MILLISECONDS)
  • 2: Seconds (SECONDS)
  • 3: Minutes (MINUTES)
  • 4: Hours (HOURS)
  • 5: Days (DAYS)
  • 6: Weeks (WEEKS)
  • 7: Months (MONTHS)
  • 8: Years (YEARS)
  • 99: Other (OTHER)
Unmapped unmapped Unmapped[] Data from the source that was not mapped into the schema.

Relationships

Time Span shown in context

Inbound Relationships

These objects and events reference Time Span in their attributes:

Outbound Relationships

Time Span references the following objects and events in its attributes:

This page describes ocsf-1.4.0