Slot: state
The state of the event or object, normalized to the caption of the state_id
value. In the case of 'Other', it is defined by the event source. See specific
usage.
URI: ocsf:state Alias: state
Applicable Classes
| Name | Description | Modifies Slot |
|---|---|---|
| QueryEvidence | The specific resulting evidence information that was queried or discovered | yes |
| Analytic | The Analytic object contains details about the analytic technique used to | yes |
| Idp | The Identity Provider object contains detailed information about a provider | yes |
| NetworkConnectionQuery | Network Connection Query events report information about active network | yes |
| WindowsQueryEvidence | The resulting evidence information that was queried | no |
| Scim | The System for Cross-domain Identity Management (SCIM) Configuration object | yes |
| SecurityFinding | Security Finding events describe findings, detections, anomalies, alerts and/... | yes |
| SecurityState | The Security State object describes the security related state of a managed | yes |
| DigitalSignature | The Digital Signature object contains information about the cryptographic | yes |
| DeviceConfigStateChange | Device Config State Change events report state changes that impact the securi... | yes |
Properties
Type and Range
| Property | Value |
|---|---|
| Range | String |
| Domain Of | QueryEvidence, Scim, SecurityState, Analytic, DigitalSignature, Idp, DeviceConfigStateChange, NetworkConnectionQuery, SecurityFinding |
Cardinality and Requirements
| Property | Value |
|---|---|
Aliases
- State
Identifier and Mapping Information
Schema Source
- from schema: https://w3id.org/lmodel/ocsf
Mappings
| Mapping Type | Mapped Value |
|---|---|
| self | ocsf:state |
| native | ocsf:state |
LinkML Source
name: state
description: 'The state of the event or object, normalized to the caption of the state_id
value. In the case of ''Other'', it is defined by the event source. See specific
usage.'
from_schema: https://w3id.org/lmodel/ocsf
aliases:
- State
rank: 1000
alias: state
domain_of:
- QueryEvidence
- Scim
- SecurityState
- Analytic
- DigitalSignature
- Idp
- DeviceConfigStateChange
- NetworkConnectionQuery
- SecurityFinding
range: string