Class: WinResource

The Windows resource object describes a resource object managed by Windows,

such as mutant or timer.

 classDiagram
    class WinResource
    click WinResource href "../WinResource/"
      Resource <|-- WinResource
        click Resource href "../Resource/"

      WinResource : created_time

      WinResource : data

      WinResource : data_classification





        WinResource --> "0..1 _recommended_" DataClassification : data_classification
        click DataClassification href "../DataClassification/"



      WinResource : data_classifications





        WinResource --> "* _recommended_" DataClassification : data_classifications
        click DataClassification href "../DataClassification/"



      WinResource : details

      WinResource : labels

      WinResource : modified_time

      WinResource : name

      WinResource : svc_name

      WinResource : tags





        WinResource --> "*" KeyValueObject : tags
        click KeyValueObject href "../KeyValueObject/"



      WinResource : type

      WinResource : type_id





        WinResource --> "1" WinResourceTypeIdEnum : type_id
        click WinResourceTypeIdEnum href "../WinResourceTypeIdEnum/"



      WinResource : uid

      WinResource : uid_alt

Inheritance

OcsfObject
- Object
  - Entity
    - Resource [ DataClassificationProfile]
      - WinResource

Slots

Name	Cardinality and Range	Description	Inheritance
details	0..1 String	The string detailing the attributes of the resource object	direct
name	0..1 recommended String	The name of the resource object	direct
svc_name	0..1 String	The Windows service acting as the object server for the resource object, such	direct
type	0..1 String	The type of the Windows resource object	direct
type_id	1 WinResourceTypeIdEnum	The normalized type identifier of the Windows resource object accessed	direct
uid	0..1 recommended String	The Windows provided handle identifier for the resource object	direct
created_time	0..1 TimestampT	The time when the resource was created	Resource
data	0..1 String	Additional data describing the resource	Resource
labels	* String	The list of labels associated to the resource	Resource
modified_time	0..1 TimestampT	The time when the resource was last modified	Resource
tags	* KeyValueObject	The list of tags; `{key:value}` pairs associated to the resource	Resource
uid_alt	0..1 String	The alternative unique identifier of the resource	Resource
data_classification	0..1 recommended DataClassification	The Data Classification object includes information about data classification	DataClassificationProfile
data_classifications	* recommended DataClassification	A list of Data Classification objects, that include information about data	DataClassificationProfile

Usages

used by	used in	type	used
WindowsResourceActivity	win_resource	range	WinResource

In Subsets

windows_extension_subset

Aliases

Windows Resource

Identifier and Mapping Information

Annotations

property	value
ocsf_extension	windows

Schema Source

from schema: https://w3id.org/lmodel/ocsf

Mappings

Mapping Type	Mapped Value
self	ocsf:WinResource
native	ocsf:WinResource

LinkML Source

Direct

name: WinResource
annotations:
  ocsf_extension:
    tag: ocsf_extension
    value: windows
description: 'The Windows resource object describes a resource object managed by Windows,

  such as mutant or timer.'
in_subset:
- windows_extension_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Windows Resource
is_a: Resource
slots:
- details
- name
- svc_name
- type
- type_id
- uid
slot_usage:
  details:
    name: details
    description: The string detailing the attributes of the resource object.
  name:
    name: name
    description: The name of the resource object.
  svc_name:
    name: svc_name
    description: 'The Windows service acting as the object server for the resource
      object, such

      as Security or Security Account Manager.'
  type:
    name: type
    description: The type of the Windows resource object.
  type_id:
    name: type_id
    description: The normalized type identifier of the Windows resource object accessed.
    range: WinResourceTypeIdEnum
    required: true
  uid:
    name: uid
    description: The Windows provided handle identifier for the resource object

Induced

name: WinResource
annotations:
  ocsf_extension:
    tag: ocsf_extension
    value: windows
description: 'The Windows resource object describes a resource object managed by Windows,

  such as mutant or timer.'
in_subset:
- windows_extension_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Windows Resource
is_a: Resource
slot_usage:
  details:
    name: details
    description: The string detailing the attributes of the resource object.
  name:
    name: name
    description: The name of the resource object.
  svc_name:
    name: svc_name
    description: 'The Windows service acting as the object server for the resource
      object, such

      as Security or Security Account Manager.'
  type:
    name: type
    description: The type of the Windows resource object.
  type_id:
    name: type_id
    description: The normalized type identifier of the Windows resource object accessed.
    range: WinResourceTypeIdEnum
    required: true
  uid:
    name: uid
    description: The Windows provided handle identifier for the resource object
attributes:
  details:
    name: details
    description: The string detailing the attributes of the resource object.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Details
    rank: 1000
    alias: details
    owner: WinResource
    domain_of:
    - WinResource
    range: string
  name:
    name: name
    description: The name of the resource object.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Name
    rank: 1000
    alias: name
    owner: WinResource
    domain_of:
    - AnalysisTarget
    - Observable
    - Os
    - Osint
    - Package
    - Parameter
    - PrivilegeInfo
    - San
    - Scim
    - Script
    - ServicePrivilegeAnalysis
    - SoftwareComponent
    - Sso
    - StartupItem
    - ThreatActor
    - Token
    - Entity
    - Resource
    - Account
    - Agent
    - AiModel
    - Aircraft
    - Analytic
    - ApplicationObject
    - Assessment
    - AutonomousSystem
    - Campaign
    - Check
    - CisBenchmark
    - CisBenchmarkResult
    - CisControl
    - ClassifierDetails
    - Container
    - D3fTactic
    - D3fTechnique
    - Database
    - Databucket
    - DomainContact
    - Edge
    - Endpoint
    - Enrichment
    - EnvironmentVariable
    - Evidences
    - Extension
    - Feature
    - File
    - Graph
    - Group
    - HttpCookie
    - HttpHeader
    - Idp
    - Image
    - Job
    - Kernel
    - KeyValueObject
    - LoadBalancer
    - Logger
    - Malware
    - ManagedEntity
    - MessageContext
    - Metric
    - Mitigation
    - NetworkInterface
    - Node
    - Organization
    - PeripheralDevice
    - Policy
    - ProcessEntity
    - Product
    - QueryInfo
    - Reporter
    - ResourceDetails
    - Rule
    - Scan
    - Service
    - SubTechnique
    - Table
    - Tactic
    - Technique
    - Trait
    - TransformationInfo
    - UnmannedAerialSystem
    - User
    - WebResource
    - Device
    - FtpActivity
    - RegValue
    - WinResource
    - WinService
    - PrefetchQuery
    range: string
    recommended: true
  svc_name:
    name: svc_name
    description: 'The Windows service acting as the object server for the resource
      object, such

      as Security or Security Account Manager.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Service Name
    rank: 1000
    alias: svc_name
    owner: WinResource
    domain_of:
    - NetworkEndpoint
    - WinResource
    range: string
  type:
    name: type
    description: The type of the Windows resource object.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Type
    rank: 1000
    alias: type
    owner: WinResource
    domain_of:
    - AnalysisTarget
    - Observable
    - Os
    - Osint
    - Package
    - PrivilegeInfo
    - ProgrammaticCredential
    - RelatedEvent
    - San
    - Sbom
    - Script
    - SoftwareComponent
    - StartupItem
    - ThreatActor
    - Ticket
    - Timespan
    - TlsExtension
    - Token
    - Dns
    - Resource
    - Account
    - Agent
    - Analytic
    - ApplicationObject
    - AuthenticationToken
    - ClassifierDetails
    - Cve
    - Database
    - Databucket
    - DiscoveryDetails
    - DnsAnswer
    - DomainContact
    - EncryptionDetails
    - Endpoint
    - Enrichment
    - File
    - Graph
    - Group
    - Ja4Fingerprint
    - Kernel
    - ManagedEntity
    - Metadata
    - Module
    - NetworkEndpoint
    - NetworkInterface
    - Node
    - PeripheralDevice
    - Policy
    - Rule
    - Scan
    - Trait
    - UnmannedAerialSystem
    - UnmannedSystemOperatingArea
    - User
    - WebResource
    - Device
    - DatastoreActivity
    - FtpActivity
    - RegValue
    - WinResource
    range: string
  type_id:
    name: type_id
    annotations:
      sibling:
        tag: sibling
        value: type
    description: The normalized type identifier of the Windows resource object accessed.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Type ID
    rank: 1000
    alias: type_id
    owner: WinResource
    domain_of:
    - Observable
    - Os
    - Osint
    - Package
    - PrivilegeInfo
    - Sbom
    - Script
    - SoftwareComponent
    - StartupItem
    - ThreatActor
    - Ticket
    - Timespan
    - TlsExtension
    - Token
    - Account
    - Agent
    - Analytic
    - AuthenticationToken
    - Database
    - Databucket
    - DomainContact
    - Endpoint
    - File
    - Ja4Fingerprint
    - Kernel
    - ManagedEntity
    - NetworkEndpoint
    - NetworkInterface
    - PeripheralDevice
    - Scan
    - UnmannedAerialSystem
    - UnmannedSystemOperatingArea
    - User
    - Device
    - DatastoreActivity
    - RegValue
    - WinResource
    range: WinResourceTypeIdEnum
    required: true
  uid:
    name: uid
    description: The Windows provided handle identifier for the resource object
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Unique ID
    rank: 1000
    alias: uid
    owner: WinResource
    domain_of:
    - Osint
    - Package
    - ProgrammaticCredential
    - RelatedEvent
    - Request
    - Sbom
    - Scim
    - Script
    - Session
    - Span
    - Sso
    - Ticket
    - Token
    - Trace
    - Entity
    - Resource
    - Account
    - Advisory
    - Agent
    - AiModel
    - Aircraft
    - Analytic
    - ApplicationObject
    - Assessment
    - Certificate
    - Check
    - ClassifierDetails
    - Container
    - Cve
    - Cwe
    - D3fTactic
    - D3fTechnique
    - DataClassification
    - Database
    - Databucket
    - DomainContact
    - Edge
    - Email
    - Endpoint
    - Evidences
    - Extension
    - Feature
    - File
    - FindingObject
    - FindingInfo
    - Graph
    - Group
    - HttpRequest
    - Idp
    - Image
    - KbArticle
    - LoadBalancer
    - Logger
    - Malware
    - ManagedEntity
    - MessageContext
    - Metadata
    - Mitigation
    - NetworkConnectionInfo
    - NetworkEndpoint
    - NetworkInterface
    - Node
    - Organization
    - PeripheralDevice
    - Policy
    - ProcessEntity
    - Product
    - QueryInfo
    - Reporter
    - Rule
    - Scan
    - Service
    - SubTechnique
    - Table
    - Tactic
    - Technique
    - Trait
    - TransformationInfo
    - UnmannedAerialSystem
    - User
    - WebResource
    - Device
    - WinResource
    range: string
    recommended: true
  created_time:
    name: created_time
    description: The time when the resource was created.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Created Time
    rank: 1000
    alias: created_time
    owner: WinResource
    domain_of:
    - Osint
    - RelatedEvent
    - Sbom
    - Scim
    - Session
    - Sso
    - Token
    - Whois
    - Resource
    - Advisory
    - AuthenticationToken
    - Certificate
    - Cve
    - Database
    - Databucket
    - DigitalSignature
    - Enrichment
    - Epss
    - File
    - FindingObject
    - FindingInfo
    - Job
    - KbArticle
    - LdapPerson
    - ProcessEntity
    - Table
    - Device
    range: TimestampT
  data:
    name: data
    description: Additional data describing the resource.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Data
    rank: 1000
    alias: data
    owner: WinResource
    domain_of:
    - Request
    - Response
    - TlsExtension
    - Resource
    - ApplicationObject
    - Edge
    - Enrichment
    - Evidences
    - ManagedEntity
    - Node
    - Policy
    - QueryInfo
    - WebResource
    - RegValue
    range: string
  labels:
    name: labels
    description: The list of labels associated to the resource.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Labels
    rank: 1000
    alias: labels
    owner: WinResource
    domain_of:
    - Osint
    - Resource
    - Account
    - ApplicationObject
    - Container
    - Image
    - LdapPerson
    - Metadata
    - Service
    range: string
    multivalued: true
  modified_time:
    name: modified_time
    description: The time when the resource was last modified.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Modified Time
    rank: 1000
    alias: modified_time
    owner: WinResource
    domain_of:
    - Osint
    - RelatedEvent
    - Scim
    - Sso
    - Token
    - Resource
    - Advisory
    - Cve
    - Database
    - Databucket
    - File
    - FindingObject
    - FindingInfo
    - LdapPerson
    - Metadata
    - Table
    - Device
    - RegKey
    - RegValue
    range: TimestampT
  tags:
    name: tags
    description: The list of tags; <code>{key:value}</code> pairs associated to the
      resource.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Tags
    rank: 1000
    alias: tags
    owner: WinResource
    domain_of:
    - RelatedEvent
    - Resource
    - Account
    - ApplicationObject
    - Container
    - File
    - FindingInfo
    - Image
    - LdapPerson
    - Metadata
    - Service
    range: KeyValueObject
    multivalued: true
  uid_alt:
    name: uid_alt
    description: The alternative unique identifier of the resource.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Alternate ID
    rank: 1000
    alias: uid_alt
    owner: WinResource
    domain_of:
    - Scim
    - Session
    - Resource
    - Agent
    - Aircraft
    - ApplicationObject
    - FindingInfo
    - Group
    - UnmannedAerialSystem
    - User
    - Device
    range: string
  data_classification:
    name: data_classification
    annotations:
      group:
        tag: group
        value: context
    description: 'The Data Classification object includes information about data classification

      levels and data category types.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Data Classification
    rank: 1000
    alias: data_classification
    owner: WinResource
    domain_of:
    - DataClassificationProfile
    range: DataClassification
    recommended: true
  data_classifications:
    name: data_classifications
    annotations:
      group:
        tag: group
        value: context
    description: 'A list of Data Classification objects, that include information
      about data

      classification levels and data category types, identified by a classifier.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Data Classification
    rank: 1000
    alias: data_classifications
    owner: WinResource
    domain_of:
    - DataClassificationProfile
    range: DataClassification
    recommended: true
    multivalued: true