Class: WindowsQueryEvidence

name: WindowsQueryEvidence
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"just_one": ["connection_info", "file", "folder", "group", "job", "kernel",

      "module", "network_interfaces", "peripheral_device", "process", "reg_key",

      "reg_value", "service", "session", "startup_item", "user"]}'
  ocsf_extension:
    tag: ocsf_extension
    value: windows
description: The resulting evidence information that was queried.
in_subset:
- windows_extension_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Query Evidence
is_a: QueryEvidence
slots:
- reg_key
- reg_value
slot_usage:
  reg_key:
    name: reg_key
    annotations:
      group:
        tag: group
        value: primary
    description: The registry key object describes a Windows registry key.
    recommended: true
  reg_value:
    name: reg_value
    annotations:
      group:
        tag: group
        value: primary
    description: The registry key object describes a Windows registry value.
    recommended: true
rules:
- postconditions:
    exactly_one_of:
    - slot_conditions:
        connection_info:
          name: connection_info
          required: true
    - slot_conditions:
        file:
          name: file
          required: true
    - slot_conditions:
        folder:
          name: folder
          required: true
    - slot_conditions:
        group:
          name: group
          required: true
    - slot_conditions:
        job:
          name: job
          required: true
    - slot_conditions:
        kernel:
          name: kernel
          required: true
    - slot_conditions:
        module:
          name: module
          required: true
    - slot_conditions:
        network_interfaces:
          name: network_interfaces
          required: true
    - slot_conditions:
        peripheral_device:
          name: peripheral_device
          required: true
    - slot_conditions:
        process:
          name: process
          required: true
    - slot_conditions:
        reg_key:
          name: reg_key
          required: true
    - slot_conditions:
        reg_value:
          name: reg_value
          required: true
    - slot_conditions:
        service:
          name: service
          required: true
    - slot_conditions:
        session:
          name: session
          required: true
    - slot_conditions:
        startup_item:
          name: startup_item
          required: true
    - slot_conditions:
        user:
          name: user
          required: true
  description: 'OCSF just_one: exactly one of [''connection_info'', ''file'', ''folder'',
    ''group'',

    ''job'', ''kernel'', ''module'', ''network_interfaces'', ''peripheral_device'',

    ''process'', ''reg_key'', ''reg_value'', ''service'', ''session'', ''startup_item'',

    ''user''] must be set.'

name: WindowsQueryEvidence
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"just_one": ["connection_info", "file", "folder", "group", "job", "kernel",

      "module", "network_interfaces", "peripheral_device", "process", "reg_key",

      "reg_value", "service", "session", "startup_item", "user"]}'
  ocsf_extension:
    tag: ocsf_extension
    value: windows
description: The resulting evidence information that was queried.
in_subset:
- windows_extension_subset
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Query Evidence
is_a: QueryEvidence
slot_usage:
  reg_key:
    name: reg_key
    annotations:
      group:
        tag: group
        value: primary
    description: The registry key object describes a Windows registry key.
    recommended: true
  reg_value:
    name: reg_value
    annotations:
      group:
        tag: group
        value: primary
    description: The registry key object describes a Windows registry value.
    recommended: true
attributes:
  reg_key:
    name: reg_key
    annotations:
      group:
        tag: group
        value: primary
    description: The registry key object describes a Windows registry key.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Registry Key
    rank: 1000
    alias: reg_key
    owner: WindowsQueryEvidence
    domain_of:
    - WindowsEvidences
    - WindowsQueryEvidence
    - RegistryKeyActivity
    - RegistryKeyQuery
    range: RegKey
    recommended: true
  reg_value:
    name: reg_value
    annotations:
      group:
        tag: group
        value: primary
    description: The registry key object describes a Windows registry value.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Registry Value
    rank: 1000
    alias: reg_value
    owner: WindowsQueryEvidence
    domain_of:
    - WindowsEvidences
    - WindowsQueryEvidence
    - RegistryValueActivity
    - RegistryValueQuery
    range: RegValue
    recommended: true
  connection_info:
    name: connection_info
    annotations:
      group:
        tag: group
        value: primary
    description: The network connection information related to a Network Connection
      query type.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Connection Info
    rank: 1000
    alias: connection_info
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - Evidences
    - FileHosting
    - NetworkConnectionQuery
    - NetworkEvent
    - DnsActivity
    - NetworkFileActivity
    - RdpActivity
    - TunnelActivity
    - NetworkRemediationActivity
    - UnmannedSystemsEvent
    range: NetworkConnectionInfo
    recommended: true
  file:
    name: file
    annotations:
      group:
        tag: group
        value: primary
    description: 'The file that is the target of the query when query_type_id indicates
      a File

      query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - File
    rank: 1000
    alias: file
    owner: WindowsQueryEvidence
    domain_of:
    - Osint
    - QueryEvidence
    - Script
    - AffectedCode
    - Databucket
    - Evidences
    - Job
    - KernelDriver
    - Module
    - Process
    - FileHosting
    - FileQuery
    - DataSecurityFinding
    - EmailFileActivity
    - FtpActivity
    - HttpActivity
    - NetworkFileActivity
    - RdpActivity
    - SmbActivity
    - SshActivity
    - FileRemediationActivity
    - EventLogActvity
    - FileActivity
    range: File
    recommended: true
  folder:
    name: folder
    annotations:
      group:
        tag: group
        value: primary
    description: 'The folder that is the target of the query when query_type_id indicates
      a

      Folder query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Folder
    rank: 1000
    alias: folder
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - FolderQuery
    range: File
    recommended: true
  group:
    name: group
    annotations:
      group:
        tag: group
        value: primary
    description: 'The administrative group that is the target of the query when query_type_id

      indicates an Admin Group query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Group
    rank: 1000
    alias: group
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - Api
    - ApplicationObject
    - Databucket
    - ManagedEntity
    - Policy
    - ResourceDetails
    - AdminGroupQuery
    - AuthorizeSession
    - GroupManagement
    - LinuxUsersProfile
    range: Group
    recommended: true
  job:
    name: job
    annotations:
      group:
        tag: group
        value: primary
    description: 'The job object that pertains to the event when query_type_id indicates
      a Job

      query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Job
    rank: 1000
    alias: job
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - StartupItem
    - Evidences
    - JobQuery
    - ScheduledJobActivity
    range: Job
    recommended: true
  kernel:
    name: kernel
    annotations:
      group:
        tag: group
        value: primary
    description: 'The kernel object that pertains to the event when query_type_id
      indicates a

      Kernel query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Kernel
    rank: 1000
    alias: kernel
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - KernelObjectQuery
    - KernelActivity
    range: Kernel
    recommended: true
  module:
    name: module
    annotations:
      group:
        tag: group
        value: primary
    description: 'The module that pertains to the event when query_type_id indicates
      a Module

      query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Module
    rank: 1000
    alias: module
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - ModuleQuery
    - ModuleActivity
    - ProcessActivity
    range: Module
    recommended: true
  network_interfaces:
    name: network_interfaces
    annotations:
      group:
        tag: group
        value: primary
    description: 'The physical or virtual network interfaces that are associated with
      the device

      when query_type_id indicates a Network Interfaces query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Network Interfaces
    rank: 1000
    alias: network_interfaces
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - Device
    - NetworksQuery
    range: NetworkInterface
    recommended: true
    multivalued: true
  peripheral_device:
    name: peripheral_device
    annotations:
      group:
        tag: group
        value: primary
    description: 'The peripheral device that triggered the event when query_type_id
      indicates a

      Peripheral Device query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Peripheral Device
    rank: 1000
    alias: peripheral_device
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - PeripheralDeviceQuery
    - PeripheralActivity
    range: PeripheralDevice
    recommended: true
  process:
    name: process
    annotations:
      group:
        tag: group
        value: primary
    description: 'The process that pertains to the event when query_type_id indicates
      a Process

      query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Process
    rank: 1000
    alias: process
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - StartupItem
    - Actor
    - Evidences
    - ModuleQuery
    - NetworkConnectionQuery
    - ProcessQuery
    - SecurityFinding
    - ProcessRemediationActivity
    - MemoryActivity
    - ProcessActivity
    range: Process
    recommended: true
  query_type:
    name: query_type
    annotations:
      group:
        tag: group
        value: classification
    description: The normalized caption of query_type_id or the source-specific query
      type.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Query Type
    rank: 1000
    alias: query_type
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    range: string
  query_type_id:
    name: query_type_id
    annotations:
      group:
        tag: group
        value: classification
    description: 'The normalized type of system query performed against a device or
      system

      component.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Query Type ID
    rank: 1000
    alias: query_type_id
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    range: QueryEvidenceQueryTypeIdEnum
    required: true
  service:
    name: service
    annotations:
      group:
        tag: group
        value: primary
    description: 'The service that pertains to the event when query_type_id indicates
      a Service

      query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Service
    rank: 1000
    alias: service
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - Span
    - Trace
    - Api
    - MessageContext
    - ServiceQuery
    - Authentication
    range: Service
    recommended: true
  session:
    name: session
    annotations:
      group:
        tag: group
        value: primary
    description: 'The authenticated user or service session when query_type_id indicates
      a

      Session query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Session
    rank: 1000
    alias: session
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - Actor
    - NetworkConnectionInfo
    - Process
    - SessionQuery
    - Authentication
    - AuthorizeSession
    - TunnelActivity
    range: Session
    recommended: true
  startup_item:
    name: startup_item
    annotations:
      group:
        tag: group
        value: primary
    description: 'The startup item object that pertains to the event when query_type_id
      indicates

      a Startup Item query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Startup Item
    rank: 1000
    alias: startup_item
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - StartupItemQuery
    range: StartupItem
    recommended: true
  state:
    name: state
    annotations:
      group:
        tag: group
        value: context
    description: 'The state of the socket, normalized to the caption of the state_id
      value. In

      the case of ''Other'', it is defined by the event source.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - State
    rank: 1000
    alias: state
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - Scim
    - SecurityState
    - Analytic
    - DigitalSignature
    - Idp
    - DeviceConfigStateChange
    - NetworkConnectionQuery
    - SecurityFinding
    range: string
  tcp_state_id:
    name: tcp_state_id
    annotations:
      group:
        tag: group
        value: context
    description: The state of the TCP socket for the network connection.
    notes:
    - RFC 9293 — https://datatracker.ietf.org/doc/html/rfc9293
    from_schema: https://w3id.org/lmodel/ocsf
    see_also:
    - https://datatracker.ietf.org/doc/html/rfc9293
    aliases:
    - TCP State ID
    rank: 1000
    alias: tcp_state_id
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    range: TcpStateIdEnum
  user:
    name: user
    annotations:
      group:
        tag: group
        value: primary
    description: The user that pertains to the event when query_type_id indicates
      a User query.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - User
    rank: 1000
    alias: user
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - Actor
    - Evidences
    - Job
    - ManagedEntity
    - Process
    - UserInventory
    - UserQuery
    - IamAnalysisFinding
    - AccountChange
    - Authentication
    - AuthorizeSession
    - GroupManagement
    - UserAccess
    - RdpActivity
    - TunnelActivity
    range: User
    recommended: true
  users:
    name: users
    annotations:
      group:
        tag: group
        value: context
    description: 'The users that belong to the administrative group when query_type_id
      indicates

      a Users query.'
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Users
    rank: 1000
    alias: users
    owner: WindowsQueryEvidence
    domain_of:
    - QueryEvidence
    - AdminGroupQuery
    range: User
    multivalued: true
rules:
- postconditions:
    exactly_one_of:
    - slot_conditions:
        connection_info:
          name: connection_info
          required: true
    - slot_conditions:
        file:
          name: file
          required: true
    - slot_conditions:
        folder:
          name: folder
          required: true
    - slot_conditions:
        group:
          name: group
          required: true
    - slot_conditions:
        job:
          name: job
          required: true
    - slot_conditions:
        kernel:
          name: kernel
          required: true
    - slot_conditions:
        module:
          name: module
          required: true
    - slot_conditions:
        network_interfaces:
          name: network_interfaces
          required: true
    - slot_conditions:
        peripheral_device:
          name: peripheral_device
          required: true
    - slot_conditions:
        process:
          name: process
          required: true
    - slot_conditions:
        reg_key:
          name: reg_key
          required: true
    - slot_conditions:
        reg_value:
          name: reg_value
          required: true
    - slot_conditions:
        service:
          name: service
          required: true
    - slot_conditions:
        session:
          name: session
          required: true
    - slot_conditions:
        startup_item:
          name: startup_item
          required: true
    - slot_conditions:
        user:
          name: user
          required: true
  description: 'OCSF just_one: exactly one of [''connection_info'', ''file'', ''folder'',
    ''group'',

    ''job'', ''kernel'', ''module'', ''network_interfaces'', ''peripheral_device'',

    ''process'', ''reg_key'', ''reg_value'', ''service'', ''session'', ''startup_item'',

    ''user''] must be set.'