Skip to content

Enum: WindowsServiceStartTypeIdEnum

The normalized identifier of the service start type.

URI: ocsf:WindowsServiceStartTypeIdEnum

Permissible Values

Value Meaning Description
UNKNOWN None The service start type is unknown
BOOT None A kernel mode driver loaded at boot
SYSTEM None A kernel mode driver loaded during system startup
AUTO None A user mode service started automatically during system startup
DEMAND None A user mode service started on demand when a process calls
DISABLED None A driver or service that cannot be started
OTHER None The service start type is not mapped

Slots

Name Description
service_start_type_id The normalized identifier of the service start type

Identifier and Mapping Information

Schema Source

LinkML Source

name: WindowsServiceStartTypeIdEnum
description: The normalized identifier of the service start type.
from_schema: https://w3id.org/lmodel/ocsf
rank: 1000
permissible_values:
  UNKNOWN:
    text: UNKNOWN
    description: The service start type is unknown.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '0'
      caption:
        tag: caption
        value: Unknown
  BOOT:
    text: BOOT
    description: A kernel mode driver loaded at boot.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '1'
      caption:
        tag: caption
        value: Boot
  SYSTEM:
    text: SYSTEM
    description: A kernel mode driver loaded during system startup.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '2'
      caption:
        tag: caption
        value: System
  AUTO:
    text: AUTO
    description: A user mode service started automatically during system startup.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '3'
      caption:
        tag: caption
        value: Auto
  DEMAND:
    text: DEMAND
    description: 'A user mode service started on demand when a process calls

      <code>StartService</code>.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '4'
      caption:
        tag: caption
        value: Demand
  DISABLED:
    text: DISABLED
    description: A driver or service that cannot be started.
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '5'
      caption:
        tag: caption
        value: Disabled
  OTHER:
    text: OTHER
    description: 'The service start type is not mapped. See the <code>service_start_type</code>

      attribute, which contains an event source specific value.'
    annotations:
      ocsf_uid:
        tag: ocsf_uid
        value: '99'
      caption:
        tag: caption
        value: Other