Class: Url

The Uniform Resource Locator (URL) object describes the characteristics of a

URL.

 classDiagram
    class Url
    click Url href "../Url/"
      Object <|-- Url
        click Object href "../Object/"

      Url : categories

      Url : category_ids





        Url --> "* _recommended_" CategoryIdsEnum : category_ids
        click CategoryIdsEnum href "../CategoryIdsEnum/"



      Url : domain

      Url : hostname

      Url : path

      Url : port

      Url : query_string

      Url : resource_type

      Url : scheme

      Url : subdomain

      Url : url_string

Inheritance

OcsfObject
- Object
  - Url

Slots

Name	Cardinality and Range	Description	Inheritance
categories	* String	The Website categorization names, as defined by `category_ids` enu...	direct
category_ids	* recommended CategoryIdsEnum	The Website categorization identifiers	direct
domain	0..1 String	The domain portion of the URL	direct
hostname	0..1 recommended HostnameT	The URL host as extracted from the URL	direct
path	0..1 recommended String	The URL path as extracted from the URL	direct
port	0..1 recommended PortT	The URL port	direct
query_string	0..1 recommended String	The query portion of the URL	direct
resource_type	0..1 String	The context in which a resource was retrieved in a web request	direct
scheme	0..1 recommended String	The scheme portion of the URL	direct
subdomain	0..1 String	The subdomain portion of the URL	direct
url_string	0..1 recommended UrlT	The URL string	direct

Usages

used by	used in	type	used
ApplicationObject	url	range	Url
Email	urls	range	Url
Evidences	url	range	Url
File	url	range	Url
HttpRequest	url	range	Url
EmailUrlActivity	url	range	Url
NetworkActivity	url	range	Url
WindowsEvidences	url	range	Url

Rules

Rule Applied	Preconditions	Postconditions	Elseconditions
any_of		`[{'slot_conditions': {'url_string': {'required': True}}}, {'slot_conditions': {'path': {'required': True}}}]`

In Subsets

objects_subset

Aliases

Uniform Resource Locator

Notes

Defined in RFC 1738 — https://datatracker.ietf.org/doc/html/rfc1738
D3FEND™ Ontology d3f:URL — https://d3fend.mitre.org/dao/artifact/d3f:URL/

Identifier and Mapping Information

Annotations

property	value
ocsf_constraints	{"at_least_one": ["url_string", "path"]}
observable_id	23

Schema Source

from schema: https://w3id.org/lmodel/ocsf

Mappings

Mapping Type	Mapped Value
self	ocsf:Url
native	ocsf:Url
exact	stix:Url, uco_master:URL

LinkML Source

Direct

name: Url
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"at_least_one": ["url_string", "path"]}'
  observable_id:
    tag: observable_id
    value: 23
description: 'The Uniform Resource Locator (URL) object describes the characteristics
  of a

  URL.'
notes:
- Defined in RFC 1738 — https://datatracker.ietf.org/doc/html/rfc1738
- D3FEND™ Ontology d3f:URL — https://d3fend.mitre.org/dao/artifact/d3f:URL/
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
see_also:
- https://datatracker.ietf.org/doc/html/rfc1738
- https://d3fend.mitre.org/dao/artifact/d3f:URL/
aliases:
- Uniform Resource Locator
exact_mappings:
- stix:Url
- uco_master:URL
is_a: Object
slots:
- categories
- category_ids
- domain
- hostname
- path
- port
- query_string
- resource_type
- scheme
- subdomain
- url_string
slot_usage:
  category_ids:
    name: category_ids
    recommended: true
  domain:
    name: domain
    description: 'The domain portion of the URL. For example: <code>example.com</code>
      in

      <code>https://sub.example.com</code>.'
  hostname:
    name: hostname
    description: 'The URL host as extracted from the URL. For example:

      <code>www.example.com</code> from

      <code>www.example.com/download/trouble</code>.'
    recommended: true
  path:
    name: path
    description: 'The URL path as extracted from the URL. For example:

      <code>/download/trouble</code> from

      <code>www.example.com/download/trouble</code>.'
    recommended: true
  port:
    name: port
    description: 'The URL port. For example: <code>80</code>.'
    recommended: true
  query_string:
    name: query_string
    recommended: true
  resource_type:
    name: resource_type
    description: The context in which a resource was retrieved in a web request.
  scheme:
    name: scheme
    recommended: true
  url_string:
    name: url_string
    description: 'The URL string. See RFC 1738. For example:

      <code>http://www.example.com/download/trouble.exe</code>. Note: The URL path

      should not populate the URL string.'
    recommended: true
rules:
- postconditions:
    any_of:
    - slot_conditions:
        url_string:
          name: url_string
          required: true
    - slot_conditions:
        path:
          name: path
          required: true
  description: 'OCSF at_least_one: at least one of [''url_string'', ''path''] must
    be set.'

Induced

name: Url
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"at_least_one": ["url_string", "path"]}'
  observable_id:
    tag: observable_id
    value: 23
description: 'The Uniform Resource Locator (URL) object describes the characteristics
  of a

  URL.'
notes:
- Defined in RFC 1738 — https://datatracker.ietf.org/doc/html/rfc1738
- D3FEND™ Ontology d3f:URL — https://d3fend.mitre.org/dao/artifact/d3f:URL/
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
see_also:
- https://datatracker.ietf.org/doc/html/rfc1738
- https://d3fend.mitre.org/dao/artifact/d3f:URL/
aliases:
- Uniform Resource Locator
exact_mappings:
- stix:Url
- uco_master:URL
is_a: Object
slot_usage:
  category_ids:
    name: category_ids
    recommended: true
  domain:
    name: domain
    description: 'The domain portion of the URL. For example: <code>example.com</code>
      in

      <code>https://sub.example.com</code>.'
  hostname:
    name: hostname
    description: 'The URL host as extracted from the URL. For example:

      <code>www.example.com</code> from

      <code>www.example.com/download/trouble</code>.'
    recommended: true
  path:
    name: path
    description: 'The URL path as extracted from the URL. For example:

      <code>/download/trouble</code> from

      <code>www.example.com/download/trouble</code>.'
    recommended: true
  port:
    name: port
    description: 'The URL port. For example: <code>80</code>.'
    recommended: true
  query_string:
    name: query_string
    recommended: true
  resource_type:
    name: resource_type
    description: The context in which a resource was retrieved in a web request.
  scheme:
    name: scheme
    recommended: true
  url_string:
    name: url_string
    description: 'The URL string. See RFC 1738. For example:

      <code>http://www.example.com/download/trouble.exe</code>. Note: The URL path

      should not populate the URL string.'
    recommended: true
attributes:
  categories:
    name: categories
    description: 'The Website categorization names, as defined by <code>category_ids</code>
      enum

      values.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Website Categorization
    rank: 1000
    alias: categories
    owner: Url
    domain_of:
    - Url
    range: string
    multivalued: true
  category_ids:
    name: category_ids
    annotations:
      sibling:
        tag: sibling
        value: categories
    description: The Website categorization identifiers.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Website Categorization IDs
    rank: 1000
    alias: category_ids
    owner: Url
    domain_of:
    - Url
    range: CategoryIdsEnum
    recommended: true
    multivalued: true
  domain:
    name: domain
    description: 'The domain portion of the URL. For example: <code>example.com</code>
      in

      <code>https://sub.example.com</code>.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Domain
    rank: 1000
    alias: domain
    owner: Url
    domain_of:
    - Url
    - Whois
    - Endpoint
    - Group
    - HttpCookie
    - Idp
    - User
    - Device
    range: string
  hostname:
    name: hostname
    description: 'The URL host as extracted from the URL. For example:

      <code>www.example.com</code> from

      <code>www.example.com/download/trouble</code>.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Hostname
    rank: 1000
    alias: hostname
    owner: Url
    domain_of:
    - Url
    - ApplicationObject
    - Databucket
    - DnsQuery
    - Endpoint
    - NetworkInterface
    - Reporter
    - ResourceDetails
    - Device
    range: HostnameT
    recommended: true
  path:
    name: path
    description: 'The URL path as extracted from the URL. For example:

      <code>/download/trouble</code> from

      <code>www.example.com/download/trouble</code>.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Path
    rank: 1000
    alias: path
    owner: Url
    domain_of:
    - Url
    - AffectedPackage
    - File
    - HttpCookie
    - Image
    - Kernel
    - Malware
    - ProcessEntity
    - Product
    - RegKey
    - RegValue
    range: string
    recommended: true
  port:
    name: port
    description: 'The URL port. For example: <code>80</code>.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Port
    rank: 1000
    alias: port
    owner: Url
    domain_of:
    - PortInfo
    - Url
    - NetworkEndpoint
    - FtpActivity
    range: PortT
    recommended: true
  query_string:
    name: query_string
    description: 'The query portion of the URL. For example: the query portion of
      the URL

      <code>http://www.example.com/search?q=bad&sort=date</code> is

      <code>q=bad&sort=date</code>.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - HTTP Query String
    rank: 1000
    alias: query_string
    owner: Url
    domain_of:
    - Url
    - QueryInfo
    range: string
    recommended: true
  resource_type:
    name: resource_type
    description: The context in which a resource was retrieved in a web request.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Resource Type
    rank: 1000
    alias: resource_type
    owner: Url
    domain_of:
    - Url
    range: string
  scheme:
    name: scheme
    description: 'The scheme portion of the URL. For example: <code>http</code>,

      <code>https</code>, <code>ftp</code>, or <code>sftp</code>.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Scheme
    rank: 1000
    alias: scheme
    owner: Url
    domain_of:
    - Url
    range: string
    recommended: true
  subdomain:
    name: subdomain
    description: 'The subdomain portion of the URL. For example: <code>sub</code>
      in

      <code>https://sub.example.com</code> or <code>sub2.sub1</code> in

      <code>https://sub2.sub1.example.com</code>.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Subdomain
    rank: 1000
    alias: subdomain
    owner: Url
    domain_of:
    - Url
    range: string
  url_string:
    name: url_string
    description: 'The URL string. See RFC 1738. For example:

      <code>http://www.example.com/download/trouble.exe</code>. Note: The URL path

      should not populate the URL string.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - URL String
    rank: 1000
    alias: url_string
    owner: Url
    domain_of:
    - Scim
    - Url
    - Idp
    - Product
    - TransformationInfo
    - WebResource
    range: UrlT
    recommended: true
rules:
- postconditions:
    any_of:
    - slot_conditions:
        url_string:
          name: url_string
          required: true
    - slot_conditions:
        path:
          name: path
          required: true
  description: 'OCSF at_least_one: at least one of [''url_string'', ''path''] must
    be set.'

Class: Url

Inheritance

Slots

Usages

Rules

In Subsets

Aliases

See Also

Notes

Identifier and Mapping Information

Annotations

Schema Source

Mappings

LinkML Source

Direct

Induced