Skip to content

Slot: original_event_uid

The unique identifier assigned to the event in its original logging system

before transformation to OCSF format. This field preserves the source system's

native event identifier, enabling traceability back to the raw log entry. For

example, a Windows Event Record ID, a syslog message ID, a Splunk _cd value, or

a database transaction log sequence number.

URI: ocsf:original_event_uid Alias: original_event_uid

Applicable Classes

Name Description Modifies Slot
Metadata The Metadata object describes the metadata associated with the event yes

Properties

Type and Range

Property Value
Range String
Domain Of Metadata

Cardinality and Requirements

Property Value

Aliases

  • Original Event ID

Identifier and Mapping Information

Schema Source

Mappings

Mapping Type Mapped Value
self ocsf:original_event_uid
native ocsf:original_event_uid

LinkML Source

name: original_event_uid
description: 'The unique identifier assigned to the event in its original logging
  system

  before transformation to OCSF format. This field preserves the source system''s

  native event identifier, enabling traceability back to the raw log entry. For

  example, a Windows Event Record ID, a syslog message ID, a Splunk _cd value, or

  a database transaction log sequence number.'
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Original Event ID
rank: 1000
alias: original_event_uid
domain_of:
- Metadata
range: string