Uniform Resource Locator
The Uniform Resource Locator(URL) object describes the characteristics of a URL. Defined in RFC 1738 and by D3FEND d3f:URL.
Attributes
Caption | Name | Type | Description |
---|---|---|---|
Website Categorization | categories |
String[] |
The Website categorization names, as defined by category_ids enum values.
|
Website Categorization IDs | category_ids |
Integer[] |
The Website categorization identifiers.
|
Domain | domain |
String |
The domain portion of the URL. For example: example.com in https://sub.example.com .
|
Hostname | hostname |
Hostname |
The URL host as extracted from the URL. For example: www.example.com from www.example.com/download/trouble .
|
Path | path |
Path Name |
The URL path as extracted from the URL. For example: /download/trouble from www.example.com/download/trouble .
|
Port | port |
Port |
The URL port. For example: 80 .
|
HTTP Query String | query_string |
String |
The query portion of the URL. For example: the query portion of the URL http://www.example.com/search?q=bad&sort=date is q=bad&sort=date .
|
Raw Data | raw_data |
JSON | The event data as received from the event source. |
Record ID | record_id |
String | Unique identifier for the object |
Reputation Scores | reputation |
Reputation[] |
Contains the original and normalized reputation scores.
|
Resource Type | resource_type |
String | The context in which a resource was retrieved in a web request. |
Scheme | scheme |
String |
The scheme portion of the URL. For example: http , https , ftp , or sftp .
|
Subdomain | subdomain |
String |
The subdomain portion of the URL. For example: sub in https://sub.example.com or sub2.sub1 in https://sub2.sub1.example.com .
|
URL Text | text |
URL String |
The URL. For example: http://www.example.com/download/trouble.exe .
|
Unmapped Data | unmapped |
Unmapped[] | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
URL String | url_string |
URL String |
The URL string. See RFC 1738. For example: http://www.example.com/download/trouble.exe . Note: The URL path should not populate the URL string.
|
Relationships
Inbound Relationships
These objects and events reference Uniform Resource Locator in their attributes:
- Network Activity
- HTTP Request
- URL Threat Intelligence
- Email URL Activity
- Email Delivery Activity
- Windows Evidence Artifacts
Outbound Relationships
Uniform Resource Locator references the following objects and events in its attributes:
This page describes qdm-1.3.2+ocsf-1.3.0
Updated 20 days ago