Class: NetworkConnectionInfo

name: NetworkConnectionInfo
description: 'The Network Connection Information object describes characteristics
  of an OSI

  Transport Layer communication, including TCP and UDP.'
notes:
- 'D3FEND™ Ontology d3f:NetworkSession —

  https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
see_also:
- https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/
aliases:
- Network Connection Information
exact_mappings:
- uco_master:NetworkConnection
close_mappings:
- stix:NetworkTraffic
is_a: Object
slots:
- boundary
- boundary_id
- community_uid
- direction
- direction_id
- flag_history
- protocol_name
- protocol_num
- protocol_ver
- protocol_ver_id
- session
- tcp_flags
- uid
slot_usage:
  boundary_id:
    name: boundary_id
    recommended: true
  direction_id:
    name: direction_id
    required: true
  protocol_name:
    name: protocol_name
    description: 'The IP protocol name in lowercase, as defined by the Internet Assigned
      Numbers

      Authority (IANA). For example: <code>tcp</code> or <code>udp</code>.'
    recommended: true
  protocol_num:
    name: protocol_num
    recommended: true
  protocol_ver:
    name: protocol_ver
    description: The Internet Protocol version.
  protocol_ver_id:
    name: protocol_ver_id
    description: The Internet Protocol version identifier.
    range: NetworkConnectionInfoProtocolVerIdEnum
    recommended: true
  uid:
    name: uid
    description: The unique identifier of the connection.
    recommended: true

name: NetworkConnectionInfo
description: 'The Network Connection Information object describes characteristics
  of an OSI

  Transport Layer communication, including TCP and UDP.'
notes:
- 'D3FEND™ Ontology d3f:NetworkSession —

  https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
see_also:
- https://d3fend.mitre.org/dao/artifact/d3f:NetworkSession/
aliases:
- Network Connection Information
exact_mappings:
- uco_master:NetworkConnection
close_mappings:
- stix:NetworkTraffic
is_a: Object
slot_usage:
  boundary_id:
    name: boundary_id
    recommended: true
  direction_id:
    name: direction_id
    required: true
  protocol_name:
    name: protocol_name
    description: 'The IP protocol name in lowercase, as defined by the Internet Assigned
      Numbers

      Authority (IANA). For example: <code>tcp</code> or <code>udp</code>.'
    recommended: true
  protocol_num:
    name: protocol_num
    recommended: true
  protocol_ver:
    name: protocol_ver
    description: The Internet Protocol version.
  protocol_ver_id:
    name: protocol_ver_id
    description: The Internet Protocol version identifier.
    range: NetworkConnectionInfoProtocolVerIdEnum
    recommended: true
  uid:
    name: uid
    description: The unique identifier of the connection.
    recommended: true
attributes:
  boundary:
    name: boundary
    description: 'The boundary of the connection, normalized to the caption of ''boundary_id''.
      In

      the case of ''Other'', it is defined by the event source. <p> For cloud

      connections, this translates to the traffic-boundary(same VPC, through IGW,

      etc.). For traditional networks, this is described as Local, Internal, or

      External.</p>'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Boundary
    rank: 1000
    alias: boundary
    owner: NetworkConnectionInfo
    domain_of:
    - NetworkConnectionInfo
    range: string
  boundary_id:
    name: boundary_id
    annotations:
      sibling:
        tag: sibling
        value: boundary
    description: '<p>The normalized identifier of the boundary of the connection.
      </p><p> For

      cloud connections, this translates to the traffic-boundary (same VPC, through

      IGW, etc.). For traditional networks, this is described as Local, Internal,
      or

      External.</p>'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Boundary ID
    rank: 1000
    alias: boundary_id
    owner: NetworkConnectionInfo
    domain_of:
    - NetworkConnectionInfo
    range: BoundaryIdEnum
    recommended: true
  community_uid:
    name: community_uid
    annotations:
      ocsf_source:
        tag: ocsf_source
        value: community_id
    description: The Community ID of the network connection.
    notes:
    - Community ID definition. — https://github.com/corelight/community-id-spec
    from_schema: https://w3id.org/lmodel/ocsf
    see_also:
    - https://github.com/corelight/community-id-spec
    aliases:
    - Community ID
    rank: 1000
    alias: community_uid
    owner: NetworkConnectionInfo
    domain_of:
    - NetworkConnectionInfo
    range: string
  direction:
    name: direction
    description: 'The direction of the initiated connection, traffic, or email, normalized
      to the

      caption of the direction_id value. In the case of ''Other'', it is defined by
      the

      event source.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Direction
    rank: 1000
    alias: direction
    owner: NetworkConnectionInfo
    domain_of:
    - NetworkConnectionInfo
    - EmailActivity
    range: string
  direction_id:
    name: direction_id
    annotations:
      sibling:
        tag: sibling
        value: direction
    description: 'The normalized identifier of the direction of the initiated connection,

      traffic, or email.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Direction ID
    rank: 1000
    alias: direction_id
    owner: NetworkConnectionInfo
    domain_of:
    - NetworkConnectionInfo
    - EmailActivity
    range: DirectionIdEnum
    required: true
  flag_history:
    name: flag_history
    description: 'The Connection Flag History summarizes events in a network connection.
      For

      example flags <code> ShAD </code> representing SYN, SYN/ACK, ACK and Data

      exchange.'
    notes:
    - 'Zeek History —

      https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is'
    from_schema: https://w3id.org/lmodel/ocsf
    see_also:
    - https://docs.zeek.org/en/master/scripts/base/protocols/conn/main.zeek.html#detailed-interface:~:text=Records%20the%20state%20history%20of%20connections%20as%20a%20string%20of%20letters.%20The%20meaning%20of%20those%20letters%20is
    aliases:
    - Connection Flag History
    rank: 1000
    alias: flag_history
    owner: NetworkConnectionInfo
    domain_of:
    - NetworkConnectionInfo
    range: string
  protocol_name:
    name: protocol_name
    description: 'The IP protocol name in lowercase, as defined by the Internet Assigned
      Numbers

      Authority (IANA). For example: <code>tcp</code> or <code>udp</code>.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Protocol Name
    rank: 1000
    alias: protocol_name
    owner: NetworkConnectionInfo
    domain_of:
    - PortInfo
    - Scim
    - Sso
    - Idp
    - NetworkConnectionInfo
    - EmailActivity
    - TunnelActivity
    - AirborneBroadcastActivity
    - DroneFlightsActivity
    range: string
    recommended: true
  protocol_num:
    name: protocol_num
    description: 'The IP protocol number, as defined by the Internet Assigned Numbers
      Authority

      (IANA). For example: <code>6</code> for TCP and <code>17</code> for UDP.'
    notes:
    - 'IANA Protocol Numbers —

      https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml'
    from_schema: https://w3id.org/lmodel/ocsf
    see_also:
    - https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
    aliases:
    - Protocol Number
    rank: 1000
    alias: protocol_num
    owner: NetworkConnectionInfo
    domain_of:
    - PortInfo
    - NetworkConnectionInfo
    range: integer
    recommended: true
  protocol_ver:
    name: protocol_ver
    description: The Internet Protocol version.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Protocol Version
    rank: 1000
    alias: protocol_ver
    owner: NetworkConnectionInfo
    domain_of:
    - NetworkConnectionInfo
    - RdpActivity
    - SshActivity
    range: string
  protocol_ver_id:
    name: protocol_ver_id
    annotations:
      sibling:
        tag: sibling
        value: protocol_ver
    description: The Internet Protocol version identifier.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Protocol Version ID
    rank: 1000
    alias: protocol_ver_id
    owner: NetworkConnectionInfo
    domain_of:
    - NetworkConnectionInfo
    range: NetworkConnectionInfoProtocolVerIdEnum
    recommended: true
  session:
    name: session
    description: The authenticated user or service session.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Session
    rank: 1000
    alias: session
    owner: NetworkConnectionInfo
    domain_of:
    - QueryEvidence
    - Actor
    - NetworkConnectionInfo
    - Process
    - SessionQuery
    - Authentication
    - AuthorizeSession
    - TunnelActivity
    range: Session
  tcp_flags:
    name: tcp_flags
    description: The network connection TCP header flags (i.e., control bits).
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - TCP Flags
    rank: 1000
    alias: tcp_flags
    owner: NetworkConnectionInfo
    domain_of:
    - NetworkConnectionInfo
    range: integer
  uid:
    name: uid
    description: The unique identifier of the connection.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Unique ID
    rank: 1000
    alias: uid
    owner: NetworkConnectionInfo
    domain_of:
    - Osint
    - Package
    - ProgrammaticCredential
    - RelatedEvent
    - Request
    - Sbom
    - Scim
    - Script
    - Session
    - Span
    - Sso
    - Ticket
    - Token
    - Trace
    - Entity
    - Resource
    - Account
    - Advisory
    - Agent
    - AiModel
    - Aircraft
    - Analytic
    - ApplicationObject
    - Assessment
    - Certificate
    - Check
    - ClassifierDetails
    - Container
    - Cve
    - Cwe
    - D3fTactic
    - D3fTechnique
    - DataClassification
    - Database
    - Databucket
    - DomainContact
    - Edge
    - Email
    - Endpoint
    - Evidences
    - Extension
    - Feature
    - File
    - FindingObject
    - FindingInfo
    - Graph
    - Group
    - HttpRequest
    - Idp
    - Image
    - KbArticle
    - LoadBalancer
    - Logger
    - Malware
    - ManagedEntity
    - MessageContext
    - Metadata
    - Mitigation
    - NetworkConnectionInfo
    - NetworkEndpoint
    - NetworkInterface
    - Node
    - Organization
    - PeripheralDevice
    - Policy
    - ProcessEntity
    - Product
    - QueryInfo
    - Reporter
    - Rule
    - Scan
    - Service
    - SubTechnique
    - Table
    - Tactic
    - Technique
    - Trait
    - TransformationInfo
    - UnmannedAerialSystem
    - User
    - WebResource
    - Device
    - WinResource
    range: string
    recommended: true