Slot: session

The authenticated user or service session.

URI: ocsf:session Alias: session

Applicable Classes

Name	Description	Modifies Slot
LinuxProcess	Extends the process object to add Linux specific fields	no
QueryEvidence	The specific resulting evidence information that was queried or discovered	yes
WindowsProcess	Extends the process object to add Windows specific fields	no
WindowsQueryEvidence	The resulting evidence information that was queried	no
SessionQuery	User Session Query events report information about existing user sessions	yes
Actor	The Actor object contains details about the user, role, application, service,	yes
TunnelActivity	Tunnel Activity events report secure tunnel establishment (such as VPN),	yes
Process	The Process object describes a running instance of a launched program	yes
Authentication	Authentication events report authentication session activities, including use...	yes
NetworkConnectionInfo	The Network Connection Information object describes characteristics of an OSI	no
AuthorizeSession	Authorize Session events report privileges or groups assigned to a new user	yes
MacosProcess	Extends the process object to add macOS specific fields	no

Properties

Type and Range

Property	Value
Range	Session
Domain Of	QueryEvidence, Actor, NetworkConnectionInfo, Process, SessionQuery, Authentication, AuthorizeSession, TunnelActivity

Cardinality and Requirements

Property	Value

Aliases

Session

Identifier and Mapping Information

Schema Source

from schema: https://w3id.org/lmodel/ocsf

Mappings

Mapping Type	Mapped Value
self	ocsf:session
native	ocsf:session

LinkML Source

name: session
description: The authenticated user or service session.
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- Session
rank: 1000
alias: session
domain_of:
- QueryEvidence
- Actor
- NetworkConnectionInfo
- Process
- SessionQuery
- Authentication
- AuthorizeSession
- TunnelActivity
range: Session