Class: Rule

The Rule object describes characteristics of a rule associated with a policy or

an event.

 classDiagram
    class Rule
    click Rule href "../Rule/"
      Entity <|-- Rule
        click Entity href "../Entity/"


      Rule <|-- FirewallRule
        click FirewallRule href "../FirewallRule/"


      Rule : category

      Rule : desc

      Rule : name

      Rule : type

      Rule : uid

      Rule : version

Inheritance

OcsfObject
- Object
  - Entity
    - Rule
      - FirewallRule

Slots

Name	Cardinality and Range	Description	Inheritance
category	0..1 String	The rule category	direct
desc	0..1 String	The description of the rule that generated the event	direct
name	0..1 recommended String	The name of the rule that generated the event	direct
type	0..1 String	The rule type	direct
uid	0..1 recommended String	The unique identifier of the rule that generated the event	direct
version	0..1 String	The rule version	direct

Usages

used by	used in	type	used
AffectedCode	rule	range	Rule
CisBenchmarkResult	rule	range	Rule

In Subsets

objects_subset

Aliases

Rule

Identifier and Mapping Information

Schema Source

from schema: https://w3id.org/lmodel/ocsf

Mappings

Mapping Type	Mapped Value
self	ocsf:Rule
native	ocsf:Rule

LinkML Source

Direct

name: Rule
description: 'The Rule object describes characteristics of a rule associated with
  a policy or

  an event.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Rule
is_a: Entity
slots:
- category
- desc
- name
- type
- uid
- version
slot_usage:
  category:
    name: category
    description: The rule category.
  desc:
    name: desc
    description: The description of the rule that generated the event.
  name:
    name: name
    description: The name of the rule that generated the event.
  type:
    name: type
    description: The rule type.
  uid:
    name: uid
    description: The unique identifier of the rule that generated the event.
  version:
    name: version
    description: 'The rule version. For example: <code>1.1</code>.'

Induced

name: Rule
description: 'The Rule object describes characteristics of a rule associated with
  a policy or

  an event.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Rule
is_a: Entity
slot_usage:
  category:
    name: category
    description: The rule category.
  desc:
    name: desc
    description: The description of the rule that generated the event.
  name:
    name: name
    description: The name of the rule that generated the event.
  type:
    name: type
    description: The rule type.
  uid:
    name: uid
    description: The unique identifier of the rule that generated the event.
  version:
    name: version
    description: 'The rule version. For example: <code>1.1</code>.'
attributes:
  category:
    name: category
    description: The rule category.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Category
    rank: 1000
    alias: category
    owner: Rule
    domain_of:
    - Osint
    - Vulnerability
    - Analytic
    - Assessment
    - Compliance
    - DataClassification
    - Rule
    - Trait
    range: string
  desc:
    name: desc
    description: The description of the rule that generated the event.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Description
    rank: 1000
    alias: desc
    owner: Rule
    domain_of:
    - Osint
    - RelatedEvent
    - Remediation
    - Vulnerability
    - Advisory
    - Analytic
    - ApplicationObject
    - Assessment
    - Check
    - CisBenchmark
    - CisBenchmarkResult
    - CisControl
    - Compliance
    - Cve
    - Database
    - Databucket
    - Enrichment
    - File
    - FindingObject
    - FindingInfo
    - Graph
    - Group
    - Job
    - Location
    - Node
    - Policy
    - Rule
    - Table
    - WebResource
    - Device
    - IncidentFinding
    range: string
  name:
    name: name
    description: The name of the rule that generated the event.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Name
    rank: 1000
    alias: name
    owner: Rule
    domain_of:
    - AnalysisTarget
    - Observable
    - Os
    - Osint
    - Package
    - Parameter
    - PrivilegeInfo
    - San
    - Scim
    - Script
    - ServicePrivilegeAnalysis
    - SoftwareComponent
    - Sso
    - StartupItem
    - ThreatActor
    - Token
    - Entity
    - Resource
    - Account
    - Agent
    - AiModel
    - Aircraft
    - Analytic
    - ApplicationObject
    - Assessment
    - AutonomousSystem
    - Campaign
    - Check
    - CisBenchmark
    - CisBenchmarkResult
    - CisControl
    - ClassifierDetails
    - Container
    - D3fTactic
    - D3fTechnique
    - Database
    - Databucket
    - DomainContact
    - Edge
    - Endpoint
    - Enrichment
    - EnvironmentVariable
    - Evidences
    - Extension
    - Feature
    - File
    - Graph
    - Group
    - HttpCookie
    - HttpHeader
    - Idp
    - Image
    - Job
    - Kernel
    - KeyValueObject
    - LoadBalancer
    - Logger
    - Malware
    - ManagedEntity
    - MessageContext
    - Metric
    - Mitigation
    - NetworkInterface
    - Node
    - Organization
    - PeripheralDevice
    - Policy
    - ProcessEntity
    - Product
    - QueryInfo
    - Reporter
    - ResourceDetails
    - Rule
    - Scan
    - Service
    - SubTechnique
    - Table
    - Tactic
    - Technique
    - Trait
    - TransformationInfo
    - UnmannedAerialSystem
    - User
    - WebResource
    - Device
    - FtpActivity
    - RegValue
    - WinResource
    - WinService
    - PrefetchQuery
    range: string
    recommended: true
  type:
    name: type
    description: The rule type.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Type
    rank: 1000
    alias: type
    owner: Rule
    domain_of:
    - AnalysisTarget
    - Observable
    - Os
    - Osint
    - Package
    - PrivilegeInfo
    - ProgrammaticCredential
    - RelatedEvent
    - San
    - Sbom
    - Script
    - SoftwareComponent
    - StartupItem
    - ThreatActor
    - Ticket
    - Timespan
    - TlsExtension
    - Token
    - Dns
    - Resource
    - Account
    - Agent
    - Analytic
    - ApplicationObject
    - AuthenticationToken
    - ClassifierDetails
    - Cve
    - Database
    - Databucket
    - DiscoveryDetails
    - DnsAnswer
    - DomainContact
    - EncryptionDetails
    - Endpoint
    - Enrichment
    - File
    - Graph
    - Group
    - Ja4Fingerprint
    - Kernel
    - ManagedEntity
    - Metadata
    - Module
    - NetworkEndpoint
    - NetworkInterface
    - Node
    - PeripheralDevice
    - Policy
    - Rule
    - Scan
    - Trait
    - UnmannedAerialSystem
    - UnmannedSystemOperatingArea
    - User
    - WebResource
    - Device
    - DatastoreActivity
    - FtpActivity
    - RegValue
    - WinResource
    range: string
  uid:
    name: uid
    description: The unique identifier of the rule that generated the event.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Unique ID
    rank: 1000
    alias: uid
    owner: Rule
    domain_of:
    - Osint
    - Package
    - ProgrammaticCredential
    - RelatedEvent
    - Request
    - Sbom
    - Scim
    - Script
    - Session
    - Span
    - Sso
    - Ticket
    - Token
    - Trace
    - Entity
    - Resource
    - Account
    - Advisory
    - Agent
    - AiModel
    - Aircraft
    - Analytic
    - ApplicationObject
    - Assessment
    - Certificate
    - Check
    - ClassifierDetails
    - Container
    - Cve
    - Cwe
    - D3fTactic
    - D3fTechnique
    - DataClassification
    - Database
    - Databucket
    - DomainContact
    - Edge
    - Email
    - Endpoint
    - Evidences
    - Extension
    - Feature
    - File
    - FindingObject
    - FindingInfo
    - Graph
    - Group
    - HttpRequest
    - Idp
    - Image
    - KbArticle
    - LoadBalancer
    - Logger
    - Malware
    - ManagedEntity
    - MessageContext
    - Metadata
    - Mitigation
    - NetworkConnectionInfo
    - NetworkEndpoint
    - NetworkInterface
    - Node
    - Organization
    - PeripheralDevice
    - Policy
    - ProcessEntity
    - Product
    - QueryInfo
    - Reporter
    - Rule
    - Scan
    - Service
    - SubTechnique
    - Table
    - Tactic
    - Technique
    - Trait
    - TransformationInfo
    - UnmannedAerialSystem
    - User
    - WebResource
    - Device
    - WinResource
    range: string
    recommended: true
  version:
    name: version
    description: 'The rule version. For example: <code>1.1</code>.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Version
    rank: 1000
    alias: version
    owner: Rule
    domain_of:
    - Os
    - Package
    - RpcInterface
    - Sbom
    - Scim
    - SoftwareComponent
    - Tls
    - Agent
    - AiModel
    - Analytic
    - Api
    - ApplicationObject
    - Attack
    - Certificate
    - Check
    - CisControl
    - CisCsc
    - Cvss
    - D3fend
    - Databucket
    - Epss
    - Extension
    - Feature
    - File
    - HttpRequest
    - Logger
    - ManagedEntity
    - Metadata
    - Policy
    - Product
    - ResourceDetails
    - Rule
    - Service
    - NtpActivity
    range: string