2006 - Data Security Finding¶
CIM Data Models: Alerts
OCSF Version: 1.0.0¶
| CIM Field | Mapping |
|---|---|
| app | metadata.product.name |
| vendor_account | cloud.account_uid |
| vendor_region | cloud.region |
| description | coalesce(message,'finding_info.desc','finding.title') |
| dest | resources{}.name |
| id | finding.uid |
| vendor_severity | severity |
| severity | case(severity_id==5, "critical", severity_id==4, "high", severity_id==3, "medium", severity_id==2, "low", severity_id==1, "informational", 1==1, "unknown") |
| signature | finding_info.title |
| signature_id | finding_info.uid |
| type | data security finding |
OCSF Version: 1.1.0¶
| CIM Field | Mapping |
|---|---|
| app | metadata.product.name |
| vendor_account | cloud.account_uid |
| vendor_region | cloud.region |
| description | coalesce(message,'finding_info.desc','finding.title') |
| dest | resources{}.name |
| id | finding.uid |
| vendor_severity | severity |
| severity | case(severity_id==5, "critical", severity_id==4, "high", severity_id==3, "medium", severity_id==2, "low", severity_id==1, "informational", 1==1, "unknown") |
| signature | finding_info.title |
| signature_id | finding_info.uid |
| type | data security finding |
OCSF Version: 1.2.0¶
| CIM Field | Mapping |
|---|---|
| app | metadata.product.name |
| vendor_account | cloud.account_uid |
| vendor_region | cloud.region |
| description | coalesce(message,'finding_info.desc','finding.title') |
| dest | resources{}.name |
| id | finding.uid |
| vendor_severity | severity |
| severity | case(severity_id==5, "critical", severity_id==4, "high", severity_id==3, "medium", severity_id==2, "low", severity_id==1, "informational", 1==1, "unknown") |
| signature | finding_info.title |
| signature_id | finding_info.uid |
| type | data security finding |
OCSF Version: 1.0.0*¶
| CIM Field | Mapping |
|---|---|
| app | metadata.product.name |
| vendor_account | cloud.account_uid |
| vendor_region | cloud.region |
| description | coalesce(message,'finding_info.desc','finding.title') |
| dest | resources{}.name |
| id | finding.uid |
| vendor_severity | severity |
| severity | case(severity_id==5, "critical", severity_id==4, "high", severity_id==3, "medium", severity_id==2, "low", severity_id==1, "informational", 1==1, "unknown") |
| signature | finding_info.title |
| signature_id | finding_info.uid |
| type | data security finding |