Windows Service
The Windows Service object describes a Windows service.
Attributes
Caption | Name | Type | Description |
---|---|---|---|
Command Line | cmd_line |
String |
The full command line used to launch the service.
|
File | file |
File[] |
The service file object.
|
Labels | labels |
String[] | The list of labels associated with the service. |
Load Order Group | load_order_group |
String | The name of the load ordering group of which this service is a member. |
Loaded Module | loaded_module_name |
String |
The name of the module loaded by the service.
|
Name | name |
String | The unique name of the service. |
Raw Data | raw_data |
JSON | The event data as received from the event source. |
Record ID | record_id |
String | Unique identifier for the object |
Run State | run_state |
String |
The service run state.
|
Run State ID | run_state_id |
Integer |
The service run state ID.
|
Service Category | service_category |
String | The service category, normalized to the caption of the service_category_id value. In the case of 'Other', it is defined by the event source. |
Service Category ID | service_category_id |
Integer |
The normalized identifier of the service category.
|
Service Dependencies | service_dependencies |
String[] | The names of other services upon which this service has a dependency. |
Service Error Control | service_error_control |
String |
The service error control, normalized to the caption of the service_error_control_id value. In the case of 'Other', it is defined by the event source.
|
Service Error Control ID | service_error_control_id |
Integer |
The normalized identifier of the service error control.
|
Service Start Name | service_start_name |
String | For a user mode service, this attribute represents the name of the account under which the service is run. For a kernel mode driver, this attribute represents the object name used to load the driver. |
Service Start Type | service_start_type |
String |
The service start type, normalized to the caption of the service_start_type_id value. In the case of 'Other', it is defined by the event source.
|
Service Start Type ID | service_start_type_id |
Integer |
The normalized identifier of the service start type.
|
Service Type | service_type |
String | The service type, normalized to the caption of the service_type_id value. In the case of 'Other', it is defined by the event source. |
Service Type ID | service_type_id |
Integer |
The normalized identifier of the service type.
|
Start Type | start_type |
String |
The service start type.
|
Start Type ID | start_type_id |
Integer |
The service start type ID.
|
Type IDs | type_ids |
Integer[] |
The service type identifiers.
|
Types | types |
String[] |
The service types.
|
Unique ID | uid |
String | The unique identifier of the service. |
Unmapped Data | unmapped |
Unmapped[] | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
Version | version |
String | The version of the service. |
Relationships
Inbound Relationships
These objects and events reference Windows Service in their attributes:
Outbound Relationships
Windows Service references the following objects and events in its attributes:
This page describes qdm-1.3.2+ocsf-1.3.0
Updated about 2 months ago