Windows Service
The Windows Service object describes a Windows service.
Attributes
| Caption | Name | Type | Description |
|---|---|---|---|
| Command Line | cmd_line |
String |
The full command line used to launch the service.
|
| File | file |
File[] |
The service file object.
|
| Labels | labels |
String[] | The list of labels associated with the service. |
| Load Order Group | load_order_group |
String | The name of the load ordering group of which this service is a member. |
| Loaded Module | loaded_module_name |
String |
The name of the module loaded by the service.
|
| Name | name |
String | The unique name of the service. |
| Raw Data | raw_data |
JSON | The event data as received from the event source. |
| Record ID | record_id |
String | Unique identifier for the object |
| Run State | run_state |
String |
The service run state.
|
| Run State ID | run_state_id |
Integer |
The service run state ID.
|
| Service Category | service_category |
String | The service category, normalized to the caption of the service_category_id value. In the case of 'Other', it is defined by the event source. |
| Service Category ID | service_category_id |
Integer |
The normalized identifier of the service category.
|
| Service Dependencies | service_dependencies |
String[] | The names of other services upon which this service has a dependency. |
| Service Error Control | service_error_control |
String |
The service error control, normalized to the caption of the service_error_control_id value. In the case of 'Other', it is defined by the event source.
|
| Service Error Control ID | service_error_control_id |
Integer |
The normalized identifier of the service error control.
|
| Service Start Name | service_start_name |
String | For a user mode service, this attribute represents the name of the account under which the service is run. For a kernel mode driver, this attribute represents the object name used to load the driver. |
| Service Start Type | service_start_type |
String |
The service start type, normalized to the caption of the service_start_type_id value. In the case of 'Other', it is defined by the event source.
|
| Service Start Type ID | service_start_type_id |
Integer |
The normalized identifier of the service start type.
|
| Service Type | service_type |
String | The service type, normalized to the caption of the service_type_id value. In the case of 'Other', it is defined by the event source. |
| Service Type ID | service_type_id |
Integer |
The normalized identifier of the service type.
|
| Start Type | start_type |
String |
The service start type.
|
| Start Type ID | start_type_id |
Integer |
The service start type ID.
|
| Type IDs | type_ids |
Integer[] |
The service type identifiers.
|
| Types | types |
String[] |
The service types.
|
| Unique ID | uid |
String | The unique identifier of the service. |
| Unmapped Data | unmapped |
Unmapped[] | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. |
| Version | version |
String | The version of the service. |
Relationships
Inbound Relationships
These objects and events reference Windows Service in their attributes:
Outbound Relationships
Windows Service references the following objects and events in its attributes:
This page describes qdm-1.3.2+ocsf-1.3.0
Updated about 17 hours ago