Skip to content

Class: VendorAttributes

The Vendor Attributes object can be used to represent values of attributes

populated by the Vendor/Finding Provider. It can help distinguish between the

vendor-provided values and consumer-updated values, of key attributes like

severity_id.
The original finding producer should not populate

this object. It should be populated by consuming systems that support data

mutability.

URI: ocsf:VendorAttributes

 classDiagram
    class VendorAttributes
    click VendorAttributes href "../VendorAttributes/"
      Object <|-- VendorAttributes
        click Object href "../Object/"

      VendorAttributes : severity

      VendorAttributes : severity_id





        VendorAttributes --> "0..1" SeverityIdEnum : severity_id
        click SeverityIdEnum href "../SeverityIdEnum/"

Inheritance

Slots

Name Cardinality and Range Description Inheritance
severity 0..1
String
 The finding severity, as reported by the Vendor (Finding Provider) direct
severity_id 0..1
SeverityIdEnum		 The finding severity ID, as reported by the Vendor (Finding Provider) direct

Usages

used by used in type used
ApplicationSecurityPostureFinding vendor_attributes range VendorAttributes
ComplianceFinding vendor_attributes range VendorAttributes
DataSecurityFinding vendor_attributes range VendorAttributes
DetectionFinding vendor_attributes range VendorAttributes
Finding vendor_attributes range VendorAttributes
IamAnalysisFinding vendor_attributes range VendorAttributes
IncidentFinding vendor_attributes range VendorAttributes
VulnerabilityFinding vendor_attributes range VendorAttributes

In Subsets

Aliases

  • Vendor Attributes

Identifier and Mapping Information

Schema Source

Mappings

Mapping Type Mapped Value
self ocsf:VendorAttributes
native ocsf:VendorAttributes

LinkML Source

Direct

name: VendorAttributes
description: 'The Vendor Attributes object can be used to represent values of attributes

  populated by the Vendor/Finding Provider. It can help distinguish between the

  vendor-provided values and consumer-updated values, of key attributes like

  <code>severity_id</code>.<br>The original finding producer should not populate

  this object. It should be populated by consuming systems that support data

  mutability.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Vendor Attributes
is_a: Object
slots:
- severity
- severity_id
slot_usage:
  severity:
    name: severity
    description: 'The finding severity, as reported by the Vendor (Finding Provider).
      The value

      should be normalized to the caption of the <code>severity_id</code> value. In

      the case of ''Other'', it is defined by the source.'
  severity_id:
    name: severity_id
    description: The finding severity ID, as reported by the Vendor (Finding Provider).

Induced

name: VendorAttributes
description: 'The Vendor Attributes object can be used to represent values of attributes

  populated by the Vendor/Finding Provider. It can help distinguish between the

  vendor-provided values and consumer-updated values, of key attributes like

  <code>severity_id</code>.<br>The original finding producer should not populate

  this object. It should be populated by consuming systems that support data

  mutability.'
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Vendor Attributes
is_a: Object
slot_usage:
  severity:
    name: severity
    description: 'The finding severity, as reported by the Vendor (Finding Provider).
      The value

      should be normalized to the caption of the <code>severity_id</code> value. In

      the case of ''Other'', it is defined by the source.'
  severity_id:
    name: severity_id
    description: The finding severity ID, as reported by the Vendor (Finding Provider).
attributes:
  severity:
    name: severity
    description: 'The finding severity, as reported by the Vendor (Finding Provider).
      The value

      should be normalized to the caption of the <code>severity_id</code> value. In

      the case of ''Other'', it is defined by the source.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Severity
    rank: 1000
    alias: severity
    owner: VendorAttributes
    domain_of:
    - Osint
    - RelatedEvent
    - VendorAttributes
    - Vulnerability
    - Check
    - Cvss
    - KbArticle
    - Malware
    - BaseEvent
    range: string
  severity_id:
    name: severity_id
    annotations:
      sibling:
        tag: sibling
        value: severity
    description: The finding severity ID, as reported by the Vendor (Finding Provider).
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Severity ID
    rank: 1000
    alias: severity_id
    owner: VendorAttributes
    domain_of:
    - Osint
    - RelatedEvent
    - VendorAttributes
    - Check
    - Malware
    - BaseEvent
    range: SeverityIdEnum