Time Span

The Time Span object represents different time period durations. If a timespan is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one may may be populated since each member is of integral type. In that case type_id if present should be set to Other.

Attributes

Caption	Name	Type	Description
Duration Milliseconds	`duration`	Long	The duration of the time span in milliseconds.
Duration Days	`duration_days`	Integer	The duration of the time span in days.
Duration Hours	`duration_hours`	Integer	The duration of the time span in hours.
Duration Minutes	`duration_mins`	Integer	The duration of the time span in minutes.
Duration Months	`duration_months`	Integer	The duration of the time span in months.
Duration Seconds	`duration_secs`	Integer	The duration of the time span in seconds.
Duration Weeks	`duration_weeks`	Integer	The duration of the time span in weeks.
Duration Years	`duration_years`	Integer	The duration of the time span in years.
Raw Data	`raw_data`	JSON	The event data as received from the event source.
Record ID	`record_id`	String	Unique identifier for the object
Time Span Type	`type`	String	The type of time span duration the object represents.
Time Span Type ID	`type_id`	Integer	The normalized identifier for the time span duration type. `0`: Unknown (`UNKNOWN`) `1`: Milliseconds (`MILLISECONDS`) `2`: Seconds (`SECONDS`) `3`: Minutes (`MINUTES`) `4`: Hours (`HOURS`) `5`: Days (`DAYS`) `6`: Weeks (`WEEKS`) `7`: Months (`MONTHS`) `8`: Years (`YEARS`) `99`: Other (`OTHER`)
Unmapped Data	`unmapped`	Unmapped[]	The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

Relationships

Inbound Relationships

These objects and events reference Time Span in their attributes:

KB Article

Outbound Relationships

Time Span references the following objects and events in its attributes:

Unmapped

This page describes qdm-1.3.2+ocsf-1.3.0