Skip to content

Enum: WindowsServiceActivityActivityIdEnum

WindowsServiceActivity activity_id values.

URI: ocsf:WindowsServiceActivityActivityIdEnum

Permissible Values

Value Meaning Description
CREATE None A service is created, for example by calling CreateService
RECONFIGURE None A service is reconfigured, for example by calling
START None A stopped service is started, for example by calling StartService</code...
STOP None A running or paused service is stopped, for example by calling
PAUSE None A running service is paused, for example by calling ControlService</cod...
CONTINUE None A paused service is continued, for example by calling
DELETE None A service is deleted, for example by calling DeleteService
UNKNOWN None The event activity is unknown
OTHER None The event activity is not mapped

Slots

Name Description
activity_id

Identifier and Mapping Information

Schema Source

LinkML Source

name: WindowsServiceActivityActivityIdEnum
description: WindowsServiceActivity activity_id values.
from_schema: https://w3id.org/lmodel/ocsf
rank: 1000
permissible_values:
  CREATE:
    text: CREATE
    description: 'A service is created, for example by calling <code>CreateService</code>.
      Refer

      to the <code>win_service</code> attribute for details.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '1'
      caption:
        tag: caption
        value: Create
  RECONFIGURE:
    text: RECONFIGURE
    description: 'A service is reconfigured, for example by calling

      <code>ChangeServiceConfig</code> or <code>ChangeServiceConfig2</code>. Refer
      to

      the <code>win_service</code> attribute for details.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '2'
      caption:
        tag: caption
        value: Reconfigure
  START:
    text: START
    description: 'A stopped service is started, for example by calling <code>StartService</code>.

      Refer to the <code>service</code> attribute for details.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '3'
      caption:
        tag: caption
        value: Start
  STOP:
    text: STOP
    description: 'A running or paused service is stopped, for example by calling

      <code>ControlService</code> or <code>ControlServiceEx</code>. Refer to the

      <code>win_service</code> attribute for details.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '4'
      caption:
        tag: caption
        value: Stop
  PAUSE:
    text: PAUSE
    description: 'A running service is paused, for example by calling <code>ControlService</code>

      or <code>ControlServiceEx</code>. Refer to the <code>win_service</code>

      attribute for details.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '5'
      caption:
        tag: caption
        value: Pause
  CONTINUE:
    text: CONTINUE
    description: 'A paused service is continued, for example by calling

      <code>ControlService</code> or <code>ControlServiceEx</code>. Refer to the

      <code>win_service</code> attribute for details.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '6'
      caption:
        tag: caption
        value: Continue
  DELETE:
    text: DELETE
    description: 'A service is deleted, for example by calling <code>DeleteService</code>.
      Refer

      to the <code>win_service</code> attribute for details.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '7'
      caption:
        tag: caption
        value: Delete
  UNKNOWN:
    text: UNKNOWN
    description: The event activity is unknown.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '0'
      caption:
        tag: caption
        value: Unknown
  OTHER:
    text: OTHER
    description: 'The event activity is not mapped. See the <code>activity_name</code>
      attribute,

      which contains a data source specific value.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '99'
      caption:
        tag: caption
        value: Other