Enum: AccountChangeActivityIdEnum

AccountChange activity_id values.

URI: ocsf:AccountChangeActivityIdEnum

Permissible Values

Value	Meaning	Description
CREATE	None	A user/role was created
ENABLE	None	A user/role was enabled
PASSWORD_CHANGE	None	An attempt was made to change a user account's password
PASSWORD_RESET	None	An attempt was made to reset a user account's password
DISABLE	None	A user/role was disabled
DELETE	None	A user/role was deleted
ATTACH_POLICY	None	An IAM Policy was attached to a user/role
DETACH_POLICY	None	An IAM Policy was detached from a user/role
LOCK	None	A user account was locked out
MFA_FACTOR_ENABLE	None	One or more authentication factors were enabled for a user account
MFA_FACTOR_DISABLE	None	One or more authentication factors were disabled for a user account
UNLOCK	None	A user account was unlocked
UNKNOWN	None	The event activity is unknown
OTHER	None	The event activity is not mapped

Slots

Name	Description
activity_id

Identifier and Mapping Information

Schema Source

• from schema: https://w3id.org/lmodel/ocsf

LinkML Source

name: AccountChangeActivityIdEnum
description: AccountChange activity_id values.
from_schema: https://w3id.org/lmodel/ocsf
rank: 1000
permissible_values:
  CREATE:
    text: CREATE
    description: A user/role was created.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '1'
      caption:
        tag: caption
        value: Create
  ENABLE:
    text: ENABLE
    description: A user/role was enabled.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '2'
      caption:
        tag: caption
        value: Enable
  PASSWORD_CHANGE:
    text: PASSWORD_CHANGE
    description: An attempt was made to change a user account's password.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '3'
      caption:
        tag: caption
        value: Password Change
  PASSWORD_RESET:
    text: PASSWORD_RESET
    description: An attempt was made to reset a user account's password.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '4'
      caption:
        tag: caption
        value: Password Reset
  DISABLE:
    text: DISABLE
    description: A user/role was disabled.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '5'
      caption:
        tag: caption
        value: Disable
  DELETE:
    text: DELETE
    description: A user/role was deleted.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '6'
      caption:
        tag: caption
        value: Delete
  ATTACH_POLICY:
    text: ATTACH_POLICY
    description: An IAM Policy was attached to a user/role.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '7'
      caption:
        tag: caption
        value: Attach Policy
  DETACH_POLICY:
    text: DETACH_POLICY
    description: An IAM Policy was detached from a user/role.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '8'
      caption:
        tag: caption
        value: Detach Policy
  LOCK:
    text: LOCK
    description: A user account was locked out.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '9'
      caption:
        tag: caption
        value: Lock
  MFA_FACTOR_ENABLE:
    text: MFA_FACTOR_ENABLE
    description: One or more authentication factors were enabled for a user account.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '10'
      caption:
        tag: caption
        value: MFA Factor Enable
  MFA_FACTOR_DISABLE:
    text: MFA_FACTOR_DISABLE
    description: One or more authentication factors were disabled for a user account.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '11'
      caption:
        tag: caption
        value: MFA Factor Disable
  UNLOCK:
    text: UNLOCK
    description: A user account was unlocked.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '12'
      caption:
        tag: caption
        value: Unlock
  UNKNOWN:
    text: UNKNOWN
    description: The event activity is unknown.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '0'
      caption:
        tag: caption
        value: Unknown
  OTHER:
    text: OTHER
    description: 'The event activity is not mapped. See the <code>activity_name</code>
      attribute,

      which contains a data source specific value.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '99'
      caption:
        tag: caption
        value: Other