6001 - Web Resources Activity
OCSF Reference
CIM Data Models: All_Changes.Network_Changes
OCSF Version: 1.0.0
| CIM Field |
Mapping |
| action |
case(activity_id==0, "unknown", activity_id==1, "create", activity_id==2, "read", activity_id==3, "update", activity_id==4, "delete", activity_id==5, "search", activity_id==6, "import", activity_id==7, "export", activity_id==8, "share", true(), "other") |
| change_type |
web_resource_activity |
| command |
coalesce('actor.process.cmd_line' , 'actor.process.file.name') |
| dvc |
metadata.log_provider |
| object |
web_resources |
| object_category |
coalesce('type_name' , 'type_uid') |
| result |
coalesce('status_code' , 'web_resources_result') |
| result_id |
status_id |
| src |
src_endpoint |
| status |
coalesce('status' , 'status_code' , 'status_id') |
| user_name |
actor.user.name |
| user_type |
coalesce('actor.user.type' , 'actor.user.type_id') |
| vendor_product |
coalesce('metadata.product.name' , 'metadata.product.vendor_name') |
OCSF Version: 1.1.0
| CIM Field |
Mapping |
| action |
case(activity_id==0, "unknown", activity_id==1, "create", activity_id==2, "read", activity_id==3, "update", activity_id==4, "delete", activity_id==5, "search", activity_id==6, "import", activity_id==7, "export", activity_id==8, "share", true(), "other") |
| change_type |
web_resource_activity |
| command |
coalesce('actor.process.cmd_line' , 'actor.process.file.name') |
| dvc |
metadata.log_provider |
| object |
web_resources |
| object_category |
coalesce('type_name' , 'type_uid') |
| result |
coalesce('status_code' , 'web_resources_result') |
| result_id |
status_id |
| src |
src_endpoint |
| status |
coalesce('status' , 'status_code' , 'status_id') |
| user_name |
actor.user.name |
| user_type |
coalesce('actor.user.type' , 'actor.user.type_id') |
| vendor_product |
coalesce('metadata.product.name' , 'metadata.product.vendor_name') |
OCSF Version: 1.2.0
| CIM Field |
Mapping |
| action |
case(activity_id==0, "unknown", activity_id==1, "create", activity_id==2, "read", activity_id==3, "update", activity_id==4, "delete", activity_id==5, "search", activity_id==6, "import", activity_id==7, "export", activity_id==8, "share", true(), "other") |
| change_type |
web_resource_activity |
| command |
coalesce('actor.process.cmd_line' , 'actor.process.file.name') |
| dvc |
metadata.log_provider |
| object |
web_resources |
| object_category |
coalesce('type_name' , 'type_uid') |
| result |
coalesce('status_code' , 'web_resources_result') |
| result_id |
status_id |
| src |
src_endpoint |
| status |
coalesce('status' , 'status_code' , 'status_id') |
| user_name |
actor.user.name |
| user_type |
coalesce('actor.user.type' , 'actor.user.type_id') |
| vendor_product |
coalesce('metadata.product.name' , 'metadata.product.vendor_name') |
OCSF Version: 1.0.0*
| CIM Field |
Mapping |
| action |
case(activity_id==0, "unknown", activity_id==1, "create", activity_id==2, "read", activity_id==3, "update", activity_id==4, "delete", activity_id==5, "search", activity_id==6, "import", activity_id==7, "export", activity_id==8, "share", true(), "other") |
| change_type |
web_resource_activity |
| command |
coalesce('actor.process.cmd_line' , 'actor.process.file.name') |
| dvc |
metadata.log_provider |
| object |
web_resources |
| object_category |
coalesce('type_name' , 'type_uid') |
| result |
coalesce('status_code' , 'web_resources_result') |
| result_id |
status_id |
| src |
src_endpoint |
| status |
coalesce('status' , 'status_code' , 'status_id') |
| user_name |
actor.user.name |
| user_type |
coalesce('actor.user.type' , 'actor.user.type_id') |
| vendor_product |
coalesce('metadata.product.name' , 'metadata.product.vendor_name') |