Class: Timespan

The Time Span object represents different time period durations. If a timespan

is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one

may be populated since each member is of integral type. In that case

type_id if present should be set to Other.

A

timespan may also be defined by its time interval boundaries,

start_time and end_time.

 classDiagram
    class Timespan
    click Timespan href "../Timespan/"
      Object <|-- Timespan
        click Object href "../Object/"

      Timespan : duration

      Timespan : duration_days

      Timespan : duration_hours

      Timespan : duration_mins

      Timespan : duration_months

      Timespan : duration_secs

      Timespan : duration_weeks

      Timespan : duration_years

      Timespan : end_time

      Timespan : start_time

      Timespan : type

      Timespan : type_id





        Timespan --> "0..1 _recommended_" TimespanTypeIdEnum : type_id
        click TimespanTypeIdEnum href "../TimespanTypeIdEnum/"

Inheritance

OcsfObject
- Object
  - Timespan

Slots

Name	Cardinality and Range	Description	Inheritance
duration	0..1 recommended Integer	The duration of the time span in milliseconds	direct
duration_days	0..1 recommended Integer	The duration of the time span in days	direct
duration_hours	0..1 recommended Integer	The duration of the time span in hours	direct
duration_mins	0..1 recommended Integer	The duration of the time span in minutes	direct
duration_months	0..1 recommended Integer	The duration of the time span in months	direct
duration_secs	0..1 recommended Integer	The duration of the time span in seconds	direct
duration_weeks	0..1 recommended Integer	The duration of the time span in weeks	direct
duration_years	0..1 recommended Integer	The duration of the time span in years	direct
end_time	0..1 recommended TimestampT	The end time or conclusion of the timespan's interval	direct
start_time	0..1 recommended TimestampT	The start time or beginning of the timespan's interval	direct
type	0..1 String	The type of time span duration the object represents	direct
type_id	0..1 recommended TimespanTypeIdEnum	The normalized identifier for the time span duration type	direct

Usages

used by	used in	type	used
Observation	timespan	range	Timespan
Advisory	avg_timespan	range	Timespan
KbArticle	avg_timespan	range	Timespan
Metadata	total_queued_duration	range	Timespan
NetworkTraffic	timespan	range	Timespan

Rules

Rule Applied	Preconditions	Postconditions	Elseconditions
any_of		[{'slot_conditions': {'duration': {'required': True}}}, {'slot_conditions': {'duration_days': {'required': True}}}, {'slot_conditions': {'duration_hours': {'required': True}}}, {'slot_conditions': {'duration_mins': {'required': True}}}, {'slot_conditions': {'duration_months': {'required': True}}}, {'slot_conditions': {'duration_secs': {'required': True}}}, {'slot_conditions': {'duration_weeks': {'required': True}}}, {'slot_conditions': {'duration_years': {'required': True}}}, {'slot_conditions': {'end_time': {'required': True}}}, {'slot_conditions': {'start_time': {'required': True}}}]

In Subsets

objects_subset

Aliases

Time Span

Identifier and Mapping Information

Annotations

property	value
ocsf_constraints	{"at_least_one": ["duration", "duration_days", "duration_hours",
"duration_mins", "duration_months", "duration_secs", "duration_weeks",
"duration_years", "end_time", "start_time"]}

Schema Source

from schema: https://w3id.org/lmodel/ocsf

Mappings

Mapping Type	Mapped Value
self	ocsf:Timespan
native	ocsf:Timespan

LinkML Source

Direct

name: Timespan
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"at_least_one": ["duration", "duration_days", "duration_hours",

      "duration_mins", "duration_months", "duration_secs", "duration_weeks",

      "duration_years", "end_time", "start_time"]}'
description: 'The Time Span object represents different time period durations. If
  a timespan

  is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one

  may be populated since each member is of integral type. In that case

  <code>type_id</code> if present should be set to <code>Other.</code><P>A

  timespan may also be defined by its time interval boundaries,

  <code>start_time</code> and <code>end_time</code>.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Time Span
is_a: Object
slots:
- duration
- duration_days
- duration_hours
- duration_mins
- duration_months
- duration_secs
- duration_weeks
- duration_years
- end_time
- start_time
- type
- type_id
slot_usage:
  duration:
    name: duration
    description: The duration of the time span in milliseconds.
    recommended: true
  duration_days:
    name: duration_days
    description: The duration of the time span in days.
    recommended: true
  duration_hours:
    name: duration_hours
    description: The duration of the time span in hours.
    recommended: true
  duration_mins:
    name: duration_mins
    description: The duration of the time span in minutes.
    recommended: true
  duration_months:
    name: duration_months
    description: The duration of the time span in months.
    recommended: true
  duration_secs:
    name: duration_secs
    description: The duration of the time span in seconds.
    recommended: true
  duration_weeks:
    name: duration_weeks
    description: The duration of the time span in weeks.
    recommended: true
  duration_years:
    name: duration_years
    description: The duration of the time span in years.
    recommended: true
  end_time:
    name: end_time
    description: The end time or conclusion of the timespan's interval.
    recommended: true
  start_time:
    name: start_time
    description: The start time or beginning of the timespan's interval.
    recommended: true
  type:
    name: type
    description: The type of time span duration the object represents.
  type_id:
    name: type_id
    description: The normalized identifier for the time span duration type.
    range: TimespanTypeIdEnum
    recommended: true
rules:
- postconditions:
    any_of:
    - slot_conditions:
        duration:
          name: duration
          required: true
    - slot_conditions:
        duration_days:
          name: duration_days
          required: true
    - slot_conditions:
        duration_hours:
          name: duration_hours
          required: true
    - slot_conditions:
        duration_mins:
          name: duration_mins
          required: true
    - slot_conditions:
        duration_months:
          name: duration_months
          required: true
    - slot_conditions:
        duration_secs:
          name: duration_secs
          required: true
    - slot_conditions:
        duration_weeks:
          name: duration_weeks
          required: true
    - slot_conditions:
        duration_years:
          name: duration_years
          required: true
    - slot_conditions:
        end_time:
          name: end_time
          required: true
    - slot_conditions:
        start_time:
          name: start_time
          required: true
  description: 'OCSF at_least_one: at least one of [''duration'', ''duration_days'',

    ''duration_hours'', ''duration_mins'', ''duration_months'', ''duration_secs'',

    ''duration_weeks'', ''duration_years'', ''end_time'', ''start_time''] must be
    set.'

Induced

name: Timespan
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"at_least_one": ["duration", "duration_days", "duration_hours",

      "duration_mins", "duration_months", "duration_secs", "duration_weeks",

      "duration_years", "end_time", "start_time"]}'
description: 'The Time Span object represents different time period durations. If
  a timespan

  is fractional, i.e. crosses one period, e.g. a week and 3 days, more than one

  may be populated since each member is of integral type. In that case

  <code>type_id</code> if present should be set to <code>Other.</code><P>A

  timespan may also be defined by its time interval boundaries,

  <code>start_time</code> and <code>end_time</code>.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Time Span
is_a: Object
slot_usage:
  duration:
    name: duration
    description: The duration of the time span in milliseconds.
    recommended: true
  duration_days:
    name: duration_days
    description: The duration of the time span in days.
    recommended: true
  duration_hours:
    name: duration_hours
    description: The duration of the time span in hours.
    recommended: true
  duration_mins:
    name: duration_mins
    description: The duration of the time span in minutes.
    recommended: true
  duration_months:
    name: duration_months
    description: The duration of the time span in months.
    recommended: true
  duration_secs:
    name: duration_secs
    description: The duration of the time span in seconds.
    recommended: true
  duration_weeks:
    name: duration_weeks
    description: The duration of the time span in weeks.
    recommended: true
  duration_years:
    name: duration_years
    description: The duration of the time span in years.
    recommended: true
  end_time:
    name: end_time
    description: The end time or conclusion of the timespan's interval.
    recommended: true
  start_time:
    name: start_time
    description: The start time or beginning of the timespan's interval.
    recommended: true
  type:
    name: type
    description: The type of time span duration the object represents.
  type_id:
    name: type_id
    description: The normalized identifier for the time span duration type.
    range: TimespanTypeIdEnum
    recommended: true
attributes:
  duration:
    name: duration
    description: The duration of the time span in milliseconds.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Duration Milliseconds
    rank: 1000
    alias: duration
    owner: Timespan
    domain_of:
    - Span
    - Timespan
    - Trace
    - FirewallRule
    - BaseEvent
    - ScanActivity
    range: integer
    recommended: true
  duration_days:
    name: duration_days
    description: The duration of the time span in days.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Duration Days
    rank: 1000
    alias: duration_days
    owner: Timespan
    domain_of:
    - Timespan
    range: integer
    recommended: true
  duration_hours:
    name: duration_hours
    description: The duration of the time span in hours.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Duration Hours
    rank: 1000
    alias: duration_hours
    owner: Timespan
    domain_of:
    - Timespan
    range: integer
    recommended: true
  duration_mins:
    name: duration_mins
    description: The duration of the time span in minutes.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Duration Minutes
    rank: 1000
    alias: duration_mins
    owner: Timespan
    domain_of:
    - Sso
    - Timespan
    range: integer
    recommended: true
  duration_months:
    name: duration_months
    description: The duration of the time span in months.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Duration Months
    rank: 1000
    alias: duration_months
    owner: Timespan
    domain_of:
    - Timespan
    range: integer
    recommended: true
  duration_secs:
    name: duration_secs
    description: The duration of the time span in seconds.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Duration Seconds
    rank: 1000
    alias: duration_secs
    owner: Timespan
    domain_of:
    - Timespan
    range: integer
    recommended: true
  duration_weeks:
    name: duration_weeks
    description: The duration of the time span in weeks.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Duration Weeks
    rank: 1000
    alias: duration_weeks
    owner: Timespan
    domain_of:
    - Timespan
    range: integer
    recommended: true
  duration_years:
    name: duration_years
    description: The duration of the time span in years.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Duration Years
    rank: 1000
    alias: duration_years
    owner: Timespan
    domain_of:
    - Timespan
    range: integer
    recommended: true
  end_time:
    name: end_time
    description: The end time or conclusion of the timespan's interval.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - End Time
    rank: 1000
    alias: end_time
    owner: Timespan
    domain_of:
    - Span
    - Timespan
    - Trace
    - NetworkTraffic
    - UnmannedSystemOperatingArea
    - MalwareScanInfo
    - BaseEvent
    - ScanActivity
    - Finding
    - IncidentFinding
    range: TimestampT
    recommended: true
  start_time:
    name: start_time
    description: The start time or beginning of the timespan's interval.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Start Time
    rank: 1000
    alias: start_time
    owner: Timespan
    domain_of:
    - Span
    - Timespan
    - Trace
    - NetworkTraffic
    - UnmannedSystemOperatingArea
    - MalwareScanInfo
    - BaseEvent
    - ScanActivity
    - Finding
    - IncidentFinding
    range: TimestampT
    recommended: true
  type:
    name: type
    description: The type of time span duration the object represents.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Type
    rank: 1000
    alias: type
    owner: Timespan
    domain_of:
    - AnalysisTarget
    - Observable
    - Os
    - Osint
    - Package
    - PrivilegeInfo
    - ProgrammaticCredential
    - RelatedEvent
    - San
    - Sbom
    - Script
    - SoftwareComponent
    - StartupItem
    - ThreatActor
    - Ticket
    - Timespan
    - TlsExtension
    - Token
    - Dns
    - Resource
    - Account
    - Agent
    - Analytic
    - ApplicationObject
    - AuthenticationToken
    - ClassifierDetails
    - Cve
    - Database
    - Databucket
    - DiscoveryDetails
    - DnsAnswer
    - DomainContact
    - EncryptionDetails
    - Endpoint
    - Enrichment
    - File
    - Graph
    - Group
    - Ja4Fingerprint
    - Kernel
    - ManagedEntity
    - Metadata
    - Module
    - NetworkEndpoint
    - NetworkInterface
    - Node
    - PeripheralDevice
    - Policy
    - Rule
    - Scan
    - Trait
    - UnmannedAerialSystem
    - UnmannedSystemOperatingArea
    - User
    - WebResource
    - Device
    - DatastoreActivity
    - FtpActivity
    - RegValue
    - WinResource
    range: string
  type_id:
    name: type_id
    annotations:
      sibling:
        tag: sibling
        value: type
    description: The normalized identifier for the time span duration type.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Type ID
    rank: 1000
    alias: type_id
    owner: Timespan
    domain_of:
    - Observable
    - Os
    - Osint
    - Package
    - PrivilegeInfo
    - Sbom
    - Script
    - SoftwareComponent
    - StartupItem
    - ThreatActor
    - Ticket
    - Timespan
    - TlsExtension
    - Token
    - Account
    - Agent
    - Analytic
    - AuthenticationToken
    - Database
    - Databucket
    - DomainContact
    - Endpoint
    - File
    - Ja4Fingerprint
    - Kernel
    - ManagedEntity
    - NetworkEndpoint
    - NetworkInterface
    - PeripheralDevice
    - Scan
    - UnmannedAerialSystem
    - UnmannedSystemOperatingArea
    - User
    - Device
    - DatastoreActivity
    - RegValue
    - WinResource
    range: TimespanTypeIdEnum
    recommended: true
rules:
- postconditions:
    any_of:
    - slot_conditions:
        duration:
          name: duration
          required: true
    - slot_conditions:
        duration_days:
          name: duration_days
          required: true
    - slot_conditions:
        duration_hours:
          name: duration_hours
          required: true
    - slot_conditions:
        duration_mins:
          name: duration_mins
          required: true
    - slot_conditions:
        duration_months:
          name: duration_months
          required: true
    - slot_conditions:
        duration_secs:
          name: duration_secs
          required: true
    - slot_conditions:
        duration_weeks:
          name: duration_weeks
          required: true
    - slot_conditions:
        duration_years:
          name: duration_years
          required: true
    - slot_conditions:
        end_time:
          name: end_time
          required: true
    - slot_conditions:
        start_time:
          name: start_time
          required: true
  description: 'OCSF at_least_one: at least one of [''duration'', ''duration_days'',

    ''duration_hours'', ''duration_mins'', ''duration_months'', ''duration_secs'',

    ''duration_weeks'', ''duration_years'', ''end_time'', ''start_time''] must be
    set.'