Class: HostProfile

The attributes that identify host/device attributes.

 classDiagram
    class HostProfile
    click HostProfile href "../HostProfile/"
      HostProfile <|-- BaseEvent
        click BaseEvent href "../BaseEvent/"

      HostProfile : actor





        HostProfile --> "0..1" Actor : actor
        click Actor href "../Actor/"



      HostProfile : device





        HostProfile --> "0..1 _recommended_" Device : device
        click Device href "../Device/"

Class Properties

Property	Value
Mixin	Yes

Slots

Name	Cardinality and Range	Description	Inheritance
actor	0..1 Actor	The actor object describes details about the user/role/process that was the	direct
device	0..1 recommended Device	An addressable device, computer system or host	direct

Mixin Usage

mixed into	description
BaseEvent	The base event is a generic and concrete event

In Subsets

host_profile_subset

Aliases

Host

Identifier and Mapping Information

Annotations

property	value
ocsf_profile	host
group	primary

Schema Source

from schema: https://w3id.org/lmodel/ocsf

Mappings

Mapping Type	Mapped Value
self	ocsf:HostProfile
native	ocsf:HostProfile

LinkML Source

Direct

name: HostProfile
annotations:
  ocsf_profile:
    tag: ocsf_profile
    value: host
  group:
    tag: group
    value: primary
description: The attributes that identify host/device attributes.
in_subset:
- host_profile_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Host
mixin: true
slots:
- actor
- device
slot_usage:
  device:
    name: device
    recommended: true

Induced

name: HostProfile
annotations:
  ocsf_profile:
    tag: ocsf_profile
    value: host
  group:
    tag: group
    value: primary
description: The attributes that identify host/device attributes.
in_subset:
- host_profile_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Host
mixin: true
slot_usage:
  device:
    name: device
    recommended: true
attributes:
  actor:
    name: actor
    description: 'The actor object describes details about the user/role/process that
      was the

      source of the activity. Note that this is not the threat actor of a campaign

      but may be part of a campaign.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Actor
    rank: 1000
    alias: actor
    owner: HostProfile
    domain_of:
    - Evidences
    - HostProfile
    - ApiActivity
    - DatastoreActivity
    - FileHosting
    - ConfigState
    - DeviceConfigStateChange
    - InventoryInfo
    - OsintInventoryInfo
    - SoftwareInfo
    - UserInventory
    - DataSecurityFinding
    - IamEvent
    - NetworkFileActivity
    - SystemEvent
    - EventLogActvity
    - FileActivity
    - KernelExtensionActivity
    - ModuleActivity
    - ProcessActivity
    - ScheduledJobActivity
    - RegistryKeyActivity
    - RegistryValueActivity
    range: Actor
  device:
    name: device
    description: An addressable device, computer system or host.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Device
    rank: 1000
    alias: device
    owner: HostProfile
    domain_of:
    - AuthFactor
    - Evidences
    - Logger
    - ManagedEntity
    - HostProfile
    - ConfigState
    - DeviceConfigStateChange
    - EvidenceInfo
    - InventoryInfo
    - PatchState
    - SoftwareInfo
    - DataSecurityFinding
    - Finding
    - RdpActivity
    - TunnelActivity
    - SystemEvent
    - EventLogActvity
    range: Device
    recommended: true