Skip to content

Class: DataClassification

The Data Classification object includes information about data classification

levels and data category types.

URI: ocsf:DataClassification

 classDiagram
    class DataClassification
    click DataClassification href "../DataClassification/"
      Object <|-- DataClassification
        click Object href "../Object/"


      DataClassification <|-- DataSecurity
        click DataSecurity href "../DataSecurity/"


      DataClassification : category

      DataClassification : category_id





        DataClassification --> "0..1 _recommended_" DataClassificationCategoryIdEnum : category_id
        click DataClassificationCategoryIdEnum href "../DataClassificationCategoryIdEnum/"



      DataClassification : classifier_details





        DataClassification --> "0..1 _recommended_" ClassifierDetails : classifier_details
        click ClassifierDetails href "../ClassifierDetails/"



      DataClassification : confidentiality

      DataClassification : confidentiality_id





        DataClassification --> "0..1 _recommended_" ConfidentialityIdEnum : confidentiality_id
        click ConfidentialityIdEnum href "../ConfidentialityIdEnum/"



      DataClassification : discovery_details





        DataClassification --> "*" DiscoveryDetails : discovery_details
        click DiscoveryDetails href "../DiscoveryDetails/"



      DataClassification : policy





        DataClassification --> "0..1" Policy : policy
        click Policy href "../Policy/"



      DataClassification : size

      DataClassification : src_url

      DataClassification : status

      DataClassification : status_details

      DataClassification : status_id





        DataClassification --> "0..1 _recommended_" DataClassificationStatusIdEnum : status_id
        click DataClassificationStatusIdEnum href "../DataClassificationStatusIdEnum/"



      DataClassification : total

      DataClassification : uid

Inheritance

Slots

Name Cardinality and Range Description Inheritance
category 0..1
String		 The name of the data classification category that data matched into, e direct
category_id 0..1 recommended
DataClassificationCategoryIdEnum		 The normalized identifier of the data classification category direct
classifier_details 0..1 recommended
ClassifierDetails		 Describes details about the classifier used for data classification direct
confidentiality 0..1
String		 The file content confidentiality, normalized to the confidentiality_id value direct
confidentiality_id 0..1 recommended
ConfidentialityIdEnum		 The normalized identifier of the file content confidentiality indicator direct
discovery_details *
DiscoveryDetails		 Details about the data discovered by classification job direct
policy 0..1
Policy		 Details about the data policy that governs data handling and security measure... direct
size 0..1
Integer		 Size of the data classified direct
src_url 0..1
UrlT		 The source URL pointing towards the full classification job details direct
status 0..1 recommended
String		 The resultant status of the classification job normalized to the caption of t... direct
status_details *
String		 The contextual description of the status, status_id value direct
status_id 0..1 recommended
DataClassificationStatusIdEnum		 The normalized status identifier of the classification job direct
total 0..1
Integer		 The total count of discovered entities, by the classification job direct
uid 0..1
String		 The unique identifier of the classification job direct

Usages

used by used in type used
Resource data_classification range DataClassification
Resource data_classifications range DataClassification
Database data_classification range DataClassification
Database data_classifications range DataClassification
Databucket data_classification range DataClassification
Databucket data_classifications range DataClassification
Email data_classification range DataClassification
Email data_classifications range DataClassification
File data_classification range DataClassification
File data_classifications range DataClassification
Metadata data_classification range DataClassification
Metadata data_classifications range DataClassification
Product data_classification range DataClassification
Product data_classifications range DataClassification
ResourceDetails data_classification range DataClassification
ResourceDetails data_classifications range DataClassification
WebResource data_classification range DataClassification
WebResource data_classifications range DataClassification
DataClassificationProfile data_classification range DataClassification
DataClassificationProfile data_classifications range DataClassification
WinResource data_classification range DataClassification
WinResource data_classifications range DataClassification

Rules

Rule Applied Preconditions Postconditions Elseconditions
any_of [{'slot_conditions': {'category_id': {'required': True}}}, {'slot_conditions': {'confidentiality_id': {'required': True}}}]

In Subsets

Aliases

  • Data Classification

Identifier and Mapping Information

Annotations

property value
ocsf_constraints {"at_least_one": ["category_id", "confidentiality_id"]}

Schema Source

Mappings

Mapping Type Mapped Value
self ocsf:DataClassification
native ocsf:DataClassification
close uco_master:MarkingDefinition

LinkML Source

Direct

name: DataClassification
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"at_least_one": ["category_id", "confidentiality_id"]}'
description: 'The Data Classification object includes information about data classification

  levels and data category types.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Data Classification
close_mappings:
- uco_master:MarkingDefinition
is_a: Object
slots:
- category
- category_id
- classifier_details
- confidentiality
- confidentiality_id
- discovery_details
- policy
- size
- src_url
- status
- status_details
- status_id
- total
- uid
slot_usage:
  category:
    name: category
    description: 'The name of the data classification category that data matched into,
      e.g.

      Financial, Personal, Governmental, etc.'
  category_id:
    name: category_id
    description: The normalized identifier of the data classification category.
    range: DataClassificationCategoryIdEnum
    recommended: true
  classifier_details:
    name: classifier_details
    recommended: true
  confidentiality_id:
    name: confidentiality_id
    recommended: true
  discovery_details:
    name: discovery_details
    description: Details about the data discovered by classification job.
  policy:
    name: policy
    description: 'Details about the data policy that governs data handling and security
      measures

      related to classification.'
  size:
    name: size
    description: Size of the data classified.
  src_url:
    name: src_url
    description: The source URL pointing towards the full classification job details.
  status:
    name: status
    description: 'The resultant status of the classification job normalized to the
      caption of the

      <code>status_id</code> value. In the case of ''Other'', it is defined by the

      event source.'
    recommended: true
  status_details:
    name: status_details
    description: The contextual description of the <code>status, status_id</code>
      value.
  status_id:
    name: status_id
    description: The normalized status identifier of the classification job.
    range: DataClassificationStatusIdEnum
    recommended: true
  total:
    name: total
    description: The total count of discovered entities, by the classification job.
  uid:
    name: uid
    description: The unique identifier of the classification job.
rules:
- postconditions:
    any_of:
    - slot_conditions:
        category_id:
          name: category_id
          required: true
    - slot_conditions:
        confidentiality_id:
          name: confidentiality_id
          required: true
  description: 'OCSF at_least_one: at least one of [''category_id'', ''confidentiality_id'']
    must

    be set.'

Induced

name: DataClassification
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"at_least_one": ["category_id", "confidentiality_id"]}'
description: 'The Data Classification object includes information about data classification

  levels and data category types.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Data Classification
close_mappings:
- uco_master:MarkingDefinition
is_a: Object
slot_usage:
  category:
    name: category
    description: 'The name of the data classification category that data matched into,
      e.g.

      Financial, Personal, Governmental, etc.'
  category_id:
    name: category_id
    description: The normalized identifier of the data classification category.
    range: DataClassificationCategoryIdEnum
    recommended: true
  classifier_details:
    name: classifier_details
    recommended: true
  confidentiality_id:
    name: confidentiality_id
    recommended: true
  discovery_details:
    name: discovery_details
    description: Details about the data discovered by classification job.
  policy:
    name: policy
    description: 'Details about the data policy that governs data handling and security
      measures

      related to classification.'
  size:
    name: size
    description: Size of the data classified.
  src_url:
    name: src_url
    description: The source URL pointing towards the full classification job details.
  status:
    name: status
    description: 'The resultant status of the classification job normalized to the
      caption of the

      <code>status_id</code> value. In the case of ''Other'', it is defined by the

      event source.'
    recommended: true
  status_details:
    name: status_details
    description: The contextual description of the <code>status, status_id</code>
      value.
  status_id:
    name: status_id
    description: The normalized status identifier of the classification job.
    range: DataClassificationStatusIdEnum
    recommended: true
  total:
    name: total
    description: The total count of discovered entities, by the classification job.
  uid:
    name: uid
    description: The unique identifier of the classification job.
attributes:
  category:
    name: category
    description: 'The name of the data classification category that data matched into,
      e.g.

      Financial, Personal, Governmental, etc.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Category
    rank: 1000
    alias: category
    owner: DataClassification
    domain_of:
    - Osint
    - Vulnerability
    - Analytic
    - Assessment
    - Compliance
    - DataClassification
    - Rule
    - Trait
    range: string
  category_id:
    name: category_id
    annotations:
      sibling:
        tag: sibling
        value: category
    description: The normalized identifier of the data classification category.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Category ID
    rank: 1000
    alias: category_id
    owner: DataClassification
    domain_of:
    - DataClassification
    range: DataClassificationCategoryIdEnum
    recommended: true
  classifier_details:
    name: classifier_details
    description: Describes details about the classifier used for data classification.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Classifier Details
    rank: 1000
    alias: classifier_details
    owner: DataClassification
    domain_of:
    - DataClassification
    range: ClassifierDetails
    recommended: true
  confidentiality:
    name: confidentiality
    description: 'The file content confidentiality, normalized to the confidentiality_id
      value.

      In the case of ''Other'', it is defined by the event source.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Confidentiality
    rank: 1000
    alias: confidentiality
    owner: DataClassification
    domain_of:
    - DataClassification
    - File
    range: string
  confidentiality_id:
    name: confidentiality_id
    annotations:
      sibling:
        tag: sibling
        value: confidentiality
    description: The normalized identifier of the file content confidentiality indicator.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Confidentiality ID
    rank: 1000
    alias: confidentiality_id
    owner: DataClassification
    domain_of:
    - DataClassification
    - File
    range: ConfidentialityIdEnum
    recommended: true
  discovery_details:
    name: discovery_details
    description: Details about the data discovered by classification job.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Discovery Details
    rank: 1000
    alias: discovery_details
    owner: DataClassification
    domain_of:
    - DataClassification
    range: DiscoveryDetails
    multivalued: true
  policy:
    name: policy
    description: 'Details about the data policy that governs data handling and security
      measures

      related to classification.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Policy
    rank: 1000
    alias: policy
    owner: DataClassification
    domain_of:
    - PermissionAnalysisResult
    - AdditionalRestriction
    - Assessment
    - Authorization
    - DataClassification
    - DataSecurity
    - ManagedEntity
    - SecurityControlProfile
    - ScanActivity
    - AccountChange
    range: Policy
  size:
    name: size
    description: Size of the data classified.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Size
    rank: 1000
    alias: size
    owner: DataClassification
    domain_of:
    - Advisory
    - Container
    - DataClassification
    - Database
    - Databucket
    - Email
    - File
    - KbArticle
    - Table
    - MalwareScanInfo
    - MemoryActivity
    range: integer
  src_url:
    name: src_url
    description: The source URL pointing towards the full classification job details.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Source URL
    rank: 1000
    alias: src_url
    owner: DataClassification
    domain_of:
    - Osint
    - Package
    - Ticket
    - Advisory
    - Cvss
    - Cwe
    - D3fTactic
    - D3fTechnique
    - DataClassification
    - Enrichment
    - FindingObject
    - FindingInfo
    - KbArticle
    - Mitigation
    - SubTechnique
    - Tactic
    - Technique
    - IncidentProfile
    - IncidentFinding
    range: UrlT
  status:
    name: status
    description: 'The resultant status of the classification job normalized to the
      caption of the

      <code>status_id</code> value. In the case of ''Other'', it is defined by the

      event source.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Status
    rank: 1000
    alias: status
    owner: DataClassification
    domain_of:
    - RelatedEvent
    - Ticket
    - Whois
    - AdditionalRestriction
    - Check
    - Compliance
    - DataClassification
    - HttpResponse
    - BaseEvent
    - Finding
    - IncidentFinding
    - DroneFlightsActivity
    range: string
    recommended: true
  status_details:
    name: status_details
    description: The contextual description of the <code>status, status_id</code>
      value.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Status Details
    rank: 1000
    alias: status_details
    owner: DataClassification
    domain_of:
    - Ticket
    - Compliance
    - DataClassification
    range: string
    multivalued: true
  status_id:
    name: status_id
    annotations:
      sibling:
        tag: sibling
        value: status
    description: The normalized status identifier of the classification job.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Status ID
    rank: 1000
    alias: status_id
    owner: DataClassification
    domain_of:
    - Ticket
    - AdditionalRestriction
    - Check
    - Compliance
    - DataClassification
    - BaseEvent
    - Finding
    - IncidentFinding
    - RemediationActivity
    - DroneFlightsActivity
    range: DataClassificationStatusIdEnum
    recommended: true
  total:
    name: total
    description: The total count of discovered entities, by the classification job.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Total
    rank: 1000
    alias: total
    owner: DataClassification
    domain_of:
    - DataClassification
    - ScanActivity
    range: integer
  uid:
    name: uid
    description: The unique identifier of the classification job.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Unique ID
    rank: 1000
    alias: uid
    owner: DataClassification
    domain_of:
    - Osint
    - Package
    - ProgrammaticCredential
    - RelatedEvent
    - Request
    - Sbom
    - Scim
    - Script
    - Session
    - Span
    - Sso
    - Ticket
    - Token
    - Trace
    - Entity
    - Resource
    - Account
    - Advisory
    - Agent
    - AiModel
    - Aircraft
    - Analytic
    - ApplicationObject
    - Assessment
    - Certificate
    - Check
    - ClassifierDetails
    - Container
    - Cve
    - Cwe
    - D3fTactic
    - D3fTechnique
    - DataClassification
    - Database
    - Databucket
    - DomainContact
    - Edge
    - Email
    - Endpoint
    - Evidences
    - Extension
    - Feature
    - File
    - FindingObject
    - FindingInfo
    - Graph
    - Group
    - HttpRequest
    - Idp
    - Image
    - KbArticle
    - LoadBalancer
    - Logger
    - Malware
    - ManagedEntity
    - MessageContext
    - Metadata
    - Mitigation
    - NetworkConnectionInfo
    - NetworkEndpoint
    - NetworkInterface
    - Node
    - Organization
    - PeripheralDevice
    - Policy
    - ProcessEntity
    - Product
    - QueryInfo
    - Reporter
    - Rule
    - Scan
    - Service
    - SubTechnique
    - Table
    - Tactic
    - Technique
    - Trait
    - TransformationInfo
    - UnmannedAerialSystem
    - User
    - WebResource
    - Device
    - WinResource
    range: string
rules:
- postconditions:
    any_of:
    - slot_conditions:
        category_id:
          name: category_id
          required: true
    - slot_conditions:
        confidentiality_id:
          name: confidentiality_id
          required: true
  description: 'OCSF at_least_one: at least one of [''category_id'', ''confidentiality_id'']
    must

    be set.'